Lightning Talk: Challenges in Cloud Native Forensics
summary
Cloud native forensics struggles because evidence vanishes fast, systems run at large scale, and platform security actively hinders analysis: serverless ~4 minutes, orchestrated containers ~0.5–1 day, and firms deploys 626 times/year so mean time to detect (weeks–months) often outlasts artifacts. Validated tooling, chain-of-custody, and provider logs like AWS CloudTrail helps matter, but memory analysis is broken by ASLR/KASLR and hardware memory obfuscation, so scalable in-cloud collection and changes to OSS projects are needed.
AI-written summary · about
chapters (11)
- 0:00Andrew Krug, Technical Evangelist @ Datadog
- 0:20Why Forensics?
- 1:16Provable and Repeatable Tool Validation
- 2:47Corollary: The key challenge areas
- 3:34Fact: Orchestration Churns Faster
- 4:32Problem: Churn Destroys Evidence Deploys Per Year
- 6:05Problem: Collection and Analysis Needs to Scale
- 6:54Two Types of Forensics : Hot and Cold
- 7:33Live Forensics was going to "save" the industry
- 8:01Problem: Security Technology has complicated this
- 9:22Call to Action
related talks
33mSpeed is key: Leveraging the Cloud for Forensic Artifact Collection & Processing
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
34mContainer Forensics: What to Do When Your Cluster is a Cluster
05mSponsored Keynote: What Can You Do in 5 Minutes?
09mLightning Talk: Bridging Silos: Real‑Time DevSecOps Telemetry for Container Def...
44mCloud Security Podcast - LIVE!
37mCSI Forensics: Unraveling Kubernetes Crime Scenes
08mKeynote: Why Wait? Find Cloud Risks and Threats in Real Time with Stream Detection