|By Jon Shende||
|December 2, 2010 06:45 AM EST||
As mentioned in Part 1 of this article, one of my functions is to research current and up and coming solutions within the technology realm, particularly that of distributed computing and cloud computing.
It is a strong possibility that malicious users will eventually identify and exploit potential flaws within the cloud computing model. CSPs, in their pursuit to secure market share may have underestimated the possibilities of attack and misuse of their cloud resources by a malicious user or users.
The likelihood that the creation, storage, processing and distribution of illicit material will present major legal issues, is also a grave reality 
Digital Forensic Examiners also know that any effective forensic system has to have an effective means of monitoring and collecting a wide range of data as; there is no directive which states what may be pertinent to any one case a priori.
With regard to possibility of insider attacks, collecting data at the entry points of a network will not contribute to tracing insider attacks.
When our admin director signed me up to attend the webinar, The Case for Network Forensics - from Solera Networks a few weeks ago; to be honest I thought that it would be a variation of some tools already in use by another start-up.
The synopsis of this webinar had me recall a paper I read a while ago by a Gartner consultant  which stated, "Cloud services are especially difficult to investigate, because logging and data for multiple customers may be co-located and may also be spread across an ever-changing set of hosts and data centres," then, I figured it was only a matter of time before a start-up proved this statement wrong.
Enter Solera's discussion on network forensics. One takeaway was that the core nature of this product is that it is like a Security camera - and it records everything.
Ok I thought, digital forensics examiners typically have vast amounts of data to sift through in a traditional system anyway; how will this company's tools expedite the sorting and analysis to output what we need that is specific to an investigation within the cloud; which will be accepted in a court of law?
Also digital evidence by itself can be extremely fragile, in that it can be altered, damaged, or destroyed by improper handling or examination. As forensic examiners we know how critical it is to ensure that precautions are taken to document, collect, preserve and examine evidence. As you know any failure in this process can render a case inadmissible in court.
I took my questions to Peter Schlampp VP Marketing and Product Management and Alan Hall Director Marketing  from Solera, who provided insight as follows.
Within the cloud Solera's tools does not use a typical custom silicate, but rather will see packets as they are seeing it as if on a traditional system NIC. Integrated into a cloud service providers environments this system claims to ensure that the customer are the only one seeing aspects of their data and no one else.
Of course I wondered about the VM managers at the cloud service provider (CSP) who manages the VMs at this point, as they can see customers' data.
The response, I received was as follows: Data tracks on the customer view, will be that of who interacted with their system in the cloud and what types of connections came in to the system hosted in the cloud. In other words it records traffic between virtual host on a physical host.
The system also has an integration with Sourcefire's defense center, although I haven't conducted a PEN-TEST in over a year, I still keep updated on current processes and technologies within the IT Security - Pen-Testing world; knowing that SNORT is utilized, was an immediate plus for me.
In the event of an incident, an investigator can drill down to event level which shows the frame of traffic; an alert from a Sourcefire event will then go directly to a Solera networks device.
Data provided from this can provide answers to: How did the connection get initiated? How do you know what happened afterwards? And for a host that was compromised one can potentially follow paths.
Despite this I still express some concerns with regard to levels of assurance for data held within the cloud amongst others. In order to get objective feedback, I approached one of my mentors Mark Pollitt for his sage input. Although he expressed his concern regarding the Solera's pitch of "network forensics for amateurs," he did state that "anything that will make analysis easier and capable of being done (even just as triage) by less skilled operators is very useful."
Whilst not an endorsement, it put my mind at ease in the sense that: the company had a vision which was on track with regard to a direction for virtualization, the cloud and forensic examination.
As a technologist there is nothing like more data and case study results to satisfy my reserve, so I presented these concerns to Schlampp and Hall, who responded with food for thought as follows:
Advanced Solera Networks network forensics technology now gives the ability to make data more understandable to a common individual. Packet detail is now rendered as web pages, emails, IMs, MS Office docs, etc. That means we can utilize support staff that can interpret this "human visible" or "human readable" data and clearly understand that the data obviously contain information we don't want leaked from our organization. With the advances Solera Networks makes, users have more front line incident response personnel that can determine if the appropriate triage requires escalation to those limited personnel that possess the in-depth skills. Those skills, combined with a complete forensics record from Solera Networks appliances, can uncover exactly what happened and more importantly, help determine the proper course of action and do so quickly to close the gap in response time between incident and remediation.
In a perfect world, effective network forensics requires the ability to "capture it all, all of the time." When we don't know what we don't know, capturing it all is the only way to ensure we have the complete data to interrogate and create the accurate story of what happened. However, what we end up with in practical use is usually something short of "everything."
We have to factor in things like amount of storage at our disposal, how fast our networks are running, what data or systems we have determined as most valuable in our organization, data protection regulations, etc. Accounting for these and other factors, Solera Networks has real-time network forensics technology that lets you make choices on what to capture - all data on every segment; selective segments of data based on port, specific applications, protocols, IP addresses, etc.; or, even get as granular as analyzing every packet for specific information like a hex pattern and only retaining those packets.
Selective capture requires a trade-off between creating more manageable "haystacks of data" and "missing the needle" altogether because it is in a different haystack of data that we didn't have the foresight to capture. Because of Solera Networks approach network forensics technology has evolved to the point where we can stick with one haystack and have the tools to find the exact needle in near real-time.
With any new product only time can tell the benefits it will provide. With regard to digital forensics and the drive to adopt cloud computing systems, any tool that will improve results, reduce false positives and give an investigator data that is relevant, factual and which can be presented and accepted in a court of law will be valued. I believe that these tools combined with a system such as that of ForNet  could chart a part for forensics investigations within the cloud ecosystem.
Accordingly ForNet :"helps with the postmortem of any security incident including insider attacks. It can also store potential evidence for months, which is much longer than any existing solution. With an integration of its XML based query routing protocols, coalescing of synopses, and a user interface, an analyst can locate evidence relating to an incident efficiently and transparently."
1.Politt MM. Six blind men from Indostan. Digital forensics research workshop (DFRWS); 2004.
2.Digital Forensics:Defining a Research Agenda -Nance,Hay Bishop 2009;978-0-7695-3450-3/09 IEEE
4. Cloud Computing Storms: Biggs, Vidalis; IJICR Vol 1, Issue 1, March 2010
5. GARTNER. 2008. Tough questions: Gartner tallies up seven cloud-computing security risks.
6.Peter Schlampp VP Marketing and Product Management,Alan Hall Director Marketing - Solera Networks
7.ForNet: A Distributed Forensic Network, Kulesh Shanmugasundaram - Project ForNet NYU Polytechnic University.
Grow your business with enterprise wearable apps using SAP Platforms and Google Glass. SAP and Google just launched the SAP and Google Glass Challenge, an opportunity for you to innovate and develop the best Enterprise Wearable App using SAP Platforms and Google Glass and gain valuable market exposure. In his session at @ThingsExpo, Brian McPhail, Senior Director of Business Development, ISVs & Digital Commerce at SAP, outlined the timeline of the SAP Google Glass Challenge and the opportunity for developers, start-ups, and companies of all sizes to engage with SAP today.
May. 28, 2015 03:00 AM EDT Reads: 4,984
Cultural, regulatory, environmental, political and economic (CREPE) conditions over the past decade are creating cross-industry solution spaces that require processes and technologies from both the Internet of Things (IoT), and Data Management and Analytics (DMA). These solution spaces are evolving into Sensor Analytics Ecosystems (SAE) that represent significant new opportunities for organizations of all types. Public Utilities throughout the world, providing electricity, natural gas and water, are pursuing SmartGrid initiatives that represent one of the more mature examples of SAE. We have s...
May. 27, 2015 11:00 PM EDT Reads: 6,007
The Internet of Things will put IT to its ultimate test by creating infinite new opportunities to digitize products and services, generate and analyze new data to improve customer satisfaction, and discover new ways to gain a competitive advantage across nearly every industry. In order to help corporate business units to capitalize on the rapidly evolving IoT opportunities, IT must stand up to a new set of challenges. In his session at @ThingsExpo, Jeff Kaplan, Managing Director of THINKstrategies, will examine why IT must finally fulfill its role in support of its SBUs or face a new round of...
May. 27, 2015 10:00 PM EDT Reads: 5,390
The true value of the Internet of Things (IoT) lies not just in the data, but through the services that protect the data, perform the analysis and present findings in a usable way. With many IoT elements rooted in traditional IT components, Big Data and IoT isn’t just a play for enterprise. In fact, the IoT presents SMBs with the prospect of launching entirely new activities and exploring innovative areas. CompTIA research identifies several areas where IoT is expected to have the greatest impact.
May. 27, 2015 09:00 PM EDT Reads: 4,898
Can call centers hang up the phones for good? Intuitive Solutions did. WebRTC enabled this contact center provider to eliminate antiquated telephony and desktop phone infrastructure with a pure web-based solution, allowing them to expand beyond brick-and-mortar confines to a home-based agent model. It also ensured scalability and better service for customers, including MUY! Companies, one of the country's largest franchise restaurant companies with 232 Pizza Hut locations. This is one example of WebRTC adoption today, but the potential is limitless when powered by IoT.
May. 27, 2015 09:00 PM EDT Reads: 6,406
One of the biggest challenges when developing connected devices is identifying user value and delivering it through successful user experiences. In his session at Internet of @ThingsExpo, Mike Kuniavsky, Principal Scientist, Innovation Services at PARC, described an IoT-specific approach to user experience design that combines approaches from interaction design, industrial design and service design to create experiences that go beyond simple connected gadgets to create lasting, multi-device experiences grounded in people's real needs and desires.
May. 27, 2015 09:00 PM EDT Reads: 6,007
The Internet of Things will greatly expand the opportunities for data collection and new business models driven off of that data. In her session at @ThingsExpo, Esmeralda Swartz, CMO of MetraTech, discussed how for this to be effective you not only need to have infrastructure and operational models capable of utilizing this new phenomenon, but increasingly service providers will need to convince a skeptical public to participate. Get ready to show them the money!
May. 27, 2015 07:00 PM EDT Reads: 5,954
SYS-CON Events announced today that MetraTech, now part of Ericsson, has been named “Silver Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York, NY. Ericsson is the driving force behind the Networked Society- a world leader in communications infrastructure, software and services. Some 40% of the world’s mobile traffic runs through networks Ericsson has supplied, serving more than 2.5 billion subscribers.
May. 27, 2015 06:45 PM EDT Reads: 1,325
The Internet of Things is not only adding billions of sensors and billions of terabytes to the Internet. It is also forcing a fundamental change in the way we envision Information Technology. For the first time, more data is being created by devices at the edge of the Internet rather than from centralized systems. What does this mean for today's IT professional? In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will addresses this very serious issue of profound change in the industry.
May. 27, 2015 06:00 PM EDT Reads: 921
SYS-CON Events announced today that BMC will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. BMC delivers software solutions that help IT transform digital enterprises for the ultimate competitive business advantage. BMC has worked with thousands of leading companies to create and deliver powerful IT management services. From mainframe to cloud to mobile, BMC pairs high-speed digital innovation with robust IT industrialization – allowing customers to provide amazing user experiences with optimized IT per...
May. 27, 2015 05:30 PM EDT Reads: 769
The Internet of Things is not new. Historically, smart businesses have used its basic concept of leveraging data to drive better decision making and have capitalized on those insights to realize additional revenue opportunities. So, what has changed to make the Internet of Things one of the hottest topics in tech? In his session at @ThingsExpo, Chris Gray, Director, Embedded and Internet of Things, discussed the underlying factors that are driving the economics of intelligent systems. Discover how hardware commoditization, the ubiquitous nature of connectivity, and the emergence of Big Data a...
May. 27, 2015 04:00 PM EDT Reads: 6,413
SYS-CON Events announced today that O'Reilly Media has been named “Media Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York City, NY. O'Reilly Media spreads the knowledge of innovators through its books, online services, magazines, and conferences. Since 1978, O'Reilly Media has been a chronicler and catalyst of cutting-edge development, homing in on the technology trends that really matter and spurring their adoption by amplifying "faint signals" from the alpha geeks who are creating the future. An active participa...
May. 27, 2015 03:37 PM EDT Reads: 508
The world is at a tipping point where the technology, the device and global adoption are converging to such a point that we will see an explosion of a world where smartphone devices not only allow us to talk to each other, but allow for communication between everything – serving as a central hub from which we control our world – MediaTek is at the heart of both driving this and allowing the markets to drive this reality forward themselves. The next wave of consumer gadgets is here – smart, connected, and small. If your ambitions are big, so are ours. In his session at @ThingsExpo, Jack Hu, D...
May. 27, 2015 12:49 PM EDT Reads: 511
The 4th International Internet of @ThingsExpo, co-located with the 17th International Cloud Expo - to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA - announces that its Call for Papers is open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
May. 27, 2015 12:00 PM EDT Reads: 1,664
SYS-CON Events announced today that DragonGlass, an enterprise search platform, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. After eleven years of designing and building custom applications, OpenCrowd has launched DragonGlass, a cloud-based platform that enables the development of search-based applications. These are a new breed of applications that utilize a search index as their backbone for data retrieval. They can easily adapt to new data sets and provide access to both structured and unstruc...
May. 27, 2015 12:00 PM EDT Reads: 1,862
We’re entering a new era of computing technology that many are calling the Internet of Things (IoT). Machine to machine, machine to infrastructure, machine to environment, the Internet of Everything, the Internet of Intelligent Things, intelligent systems – call it what you want, but it’s happening, and its potential is huge. IoT is comprised of smart machines interacting and communicating with other machines, objects, environments and infrastructures. As a result, huge volumes of data are being generated, and that data is being processed into useful actions that can “command and control” thi...
May. 27, 2015 11:51 AM EDT Reads: 511
As the Internet of Things unfolds, mobile and wearable devices are blurring the line between physical and digital, integrating ever more closely with our interests, our routines, our daily lives. Contextual computing and smart, sensor-equipped spaces bring the potential to walk through a world that recognizes us and responds accordingly. We become continuous transmitters and receivers of data. In his session at @ThingsExpo, Andrew Bolwell, Director of Innovation for HP's Printing and Personal Systems Group, discussed how key attributes of mobile technology – touch input, sensors, social, and ...
May. 27, 2015 11:30 AM EDT Reads: 3,963
All major researchers estimate there will be tens of billions devices - computers, smartphones, tablets, and sensors - connected to the Internet by 2020. This number will continue to grow at a rapid pace for the next several decades. With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo, June 9-11, 2015, at the Javits Center in New York City. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be
May. 27, 2015 11:15 AM EDT Reads: 2,038
WebRTC defines no default signaling protocol, causing fragmentation between WebRTC silos. SIP and XMPP provide possibilities, but come with considerable complexity and are not designed for use in a web environment. In his session at @ThingsExpo, Matthew Hodgson, technical co-founder of the Matrix.org, discussed how Matrix is a new non-profit Open Source Project that defines both a new HTTP-based standard for VoIP & IM signaling and provides reference implementations.
May. 27, 2015 10:30 AM EDT Reads: 5,181
Buzzword alert: Microservices and IoT at a DevOps conference? What could possibly go wrong? In this Power Panel at DevOps Summit, moderated by Jason Bloomberg, the leading expert on architecting agility for the enterprise and president of Intellyx, panelists will peel away the buzz and discuss the important architectural principles behind implementing IoT solutions for the enterprise. As remote IoT devices and sensors become increasingly intelligent, they become part of our distributed cloud environment, and we must architect and code accordingly. At the very least, you'll have no problem fil...
May. 27, 2015 10:00 AM EDT Reads: 1,823