System and method for implementing digital cloud forensics

1. A system for providing digital cloud forensics, the system comprising:

an object storage component;

a computer processor, coupled to the object storage component, that is configured to execute:

an orchestration layer configured to execute logic to:

identify a current environment for staging a cloud environment, wherein the current environment comprises one or more of an operating system, a host computer, and an application architecture;

update forensic tools in a local repository, wherein the forensic tools comprise memory acquisition module and live response scripts;

create a forensic clean room Virtual Private Cloud (VPC), wherein the VPC is isolated from potentially compromised normal business operations; and

create encrypted volume to store a forensic toolset of live response scripts and triage tools from an object storage;

an acquisition microservice that interfaces between the logic executed on the orchestration layer and a cloud platform and further acquires forensic artifacts based on the logic executing on the orchestration layer by:

receiving an alert from a monitoring system;

gathering, in response to the alert, inventory metadata related to an incident that caused the alert;

applying network isolation to a victim of the incident that caused the alert;

creating evidence storage volume based on the inventory metadata;

execute one or more live response scripts from the updated forensic tools stored in the encrypted volume to image memory associated with the incident;

running malware detection on the image memory associated with the incident;

collecting one or more pieces of volatile data in the image memory associated with the incident; and

collect, from the execution of the one or more live response scripts, forensic artifacts for the incident;

a forensic data processor that processes data acquired from the acquisition microservice into normalized datasets that are used as an input to a data classification and initial triage component; and

an analysis processor configured to:

apply data mining and classification algorithms to the normalized datasets to identify anomalies; and

initiate classification and triage of the normalized datasets.

2. The system of claim 1 , wherein the plurality of forensic processing stages comprises one or more of: forensic acquisition, data processing, storage and automated classification and triage.

3. The system of claim 1 , wherein the cloud platform is distributed across a plurality of providers.

4. The system of claim 3 , wherein the plurality of providers comprises a plurality of cloud service providers and IaaS (Infrastructure as a Service) providers.

5. The system of claim 1 , wherein the cloud platform comprises a plurality of containers, a PaaS (Platform as a Service) orchestration API and an Orchestration Platform.

6. The system of claim 1 , wherein the acquisition microservice further executes a forensic playbook and creates a forensic white box.

7. The system of claim 1 , wherein the datasets are normalized.

8. The system of claim 1 , wherein the orchestration layer and the acquisition microservice interact via an API.

9. The system of claim 1 , wherein the orchestration layer provides a consistent view between on-premises and the cloud platform.

10. The system of claim 9 , wherein the cloud platform comprises a plurality of cloud providers.

11. A method for providing digital cloud forensics, the method comprising the steps of:

executing logic, via an orchestration layer, to:

identify a current environment for staging a cloud environment, wherein the current environment comprises one or more of an operating system, a host computer, and an application architecture;

update forensic tools in a local repository, wherein the forensic tools comprise memory acquisition module and live response scripts;

create a forensic clean room Virtual Private Cloud (VPC), wherein the VPC is isolated from potentially compromised normal business operations; and

create encrypted volume to store a forensic toolset of live response scripts and triage tools from an object storage;

acquiring, via an acquisition microservice that interfaces between the logic executed on the orchestration layer and a cloud platform, forensic artifacts based on the logic executing on the orchestration layer by:

receiving an alert from a monitoring system;

gathering, in response to the alert, inventory metadata related to an incident that caused the alert;

applying network isolation to a victim of the incident that caused the alert;

creating evidence storage volume based on the inventory metadata;

execute one or more live response scripts from the updated forensic tools stored in the encrypted volume to image memory associated with the incident;

running malware malware detection on the image memory associated with the incident;

collecting one or more pieces of volatile data in the image memory associated with the incident; and

collect, from the execution of the one or more live response scripts, forensic artifacts for the incident;

processing, via a forensic data processor, data acquired from the acquisition microservice into normalized datasets that are used as an input to a data classification and initial triage component; and

applying, an analysis processor, data mining and classification algorithms to the normalized datasets to identify anomalies; and

initiating classification and triage of the normalized datasets.

12. The method of claim 11 , wherein the plurality of forensic processing stages comprises one or more of: forensic acquisition, data processing, storage and automated classification and triage.

13. The method of claim 11 , wherein the cloud platform is distributed across a plurality of providers.

14. The method of claim 11 , wherein the cloud platform comprises a plurality of containers, a PaaS (Platform as a Service) orchestration API and an Orchestration Platform.

15. The method of claim 11 , wherein the acquisition microservice further executes a forensic playbook and creates a forensic white box.

16. The method of claim 11 , wherein the orchestration layer and the acquisition microservice interact via an API.

17. The method of claim 11 , wherein the orchestration layer provides a consistent view between on-premises and the cloud platform comprising a plurality of cloud providers.