Forensic Artifacts in Free Tiers of Azure, GCP, and AWS

Track 1
5 Feb 2022 2:00 PM - 3:00 PM

As individuals and companies look for ways to save money, cloud providers incentivize choosing their service over others. Unless they are demoing a security project, security isn't a forethought until an incident happens. Free cloud tiers are the focus, as there may not be money invested by the individual/organization, especially in something like a project demo. There are two simulated threats, so we cover what artifacts are generated, and opinions on the ease and quality of the information.

Kyle Nordby
DFIR Enthusiast
@youmusec

Kyle Nordby (GCFE, GCFA, GCIH, GCIA) is an information security professional that has years of experience in a large retail Security Operations Center (SOC), and works in an Incident Response (IR) focused role. He is currently working on his Master's with an IR focus. His work ranges in threat hunting, IR, SOC operations, and endpoint triage. He is survived by his two cats, Lina and Jupiter.