Lab notebook
In-depth analyses of malware samples, technique deep-dives, and lab notes from the field. Long-form, technical, no fluff.
54 articles in "cloud-security" — page 1 of 6
Chain of custody documents the complete history of evidence — who collected it, how it was stored, and who had access. In cloud forensics, where evidence is API-sourced and inherently mutable, maintaining an unbroken chain requires specific technical and procedural controls.
Cloud-scale forensics requires tools capable of querying billions of log events in minutes. Amazon Athena, Splunk, and OpenSearch each provide this capability with different trade-offs. This article covers practical query patterns for forensic investigation.
Volatile data — running processes, network connections, memory contents, and instance metadata — disappears when an EC2 instance is terminated. Cloud forensics must capture this evidence before auto-scaling or incident remediation destroys it.
Cloud infrastructure is both a target for malware and an ideal platform for malware analysis. This article covers cloud-hosted malware sandbox architectures, static and dynamic analysis of cloud-delivered malware, and detecting malware in container images and Lambda packages.
Cloud forensic evidence must satisfy the legal admissibility standards of the jurisdiction in which it will be used. This article covers the Indian legal framework for digital evidence, the structure of a forensic report, expert witness obligations, and the BSA 2023 Section 63 certificate.
A Security Information and Event Management (SIEM) system aggregates logs from all cloud sources for correlation and threat detection. SOAR (Security Orchestration, Automation, and Response) automates the playbook execution when threats are detected. This article covers both in the cloud context.
OpenStack is the open-source cloud platform underlying NIC MeghRaj (India's National Cloud) and many large enterprise private clouds. Understanding its component security model is essential for government and large-enterprise cloud security practitioners in India.
Serverless platforms like AWS Lambda, Azure Functions, and Google Cloud Functions abstract the infrastructure entirely — but they do not abstract the security. This article examines the unique attack surface, isolation model, and security controls for serverless workloads.
Cloud incident response differs from traditional IR in critical ways — cloud resources are ephemeral, attacker actions are API calls, and evidence is in managed logs. This article describes the cloud IR lifecycle, core playbooks for common scenarios, and CERT-In reporting obligations.
