Course Summary
In this course, you will explore how major cloud service providers—Microsoft Azure, Amazon AWS, and Google Cloud Platform—are enhancing analysts’ capabilities with new evidence sources that are not available in traditional on-premise investigations. From cloud-based network traffic monitoring to direct hypervisor interaction for evidence preservation, forensics is evolving with innovative technologies and tools.
Incident response and forensics revolve around tracing the digital footprints left by attackers, and these footprints are often found in logs. Understanding the investigation process is crucial, often more so than the technicalities of log collection.
Log generation, collection, storage, and retention in cloud environments
Identification of malicious and anomalous activities affecting cloud resources
Data extraction from cloud environments for forensic investigations
AWS Cloud Platform Logging
The candidate will demonstrate an understanding of the information available from the generation, collection, retention and storage of logs from AWS
AWS Structure and Access Methods
The candidate will demonstrate an understanding of AWS architectures, logging, data access and the investigative possibilities
Azure & M365 Cloud Platform Logging
The candidate will demonstrate an understanding of the information available from the generation, collection, retention and storage of logs from Azure & M365
Azure & M365 Structure and Access Methods
The candidate will demonstrate an understanding of Azure and M365 architectures, logging, data access and the investigative possibilities
Cloud Forensic Artifact Techniques
The candidate will demonstrate an understanding of the services, tools and resources available to assist with and automate forensic investigations
Cloud Storage Platforms
The candidate will demonstrate an understanding of the different characteristics of each cloud’s storage resources. The candidate will demonstrate an understanding of ways to create, secure, access and use each storage type.
Cloud Virtual Machine Architecture
The candidate will demonstrate an understanding of the different types, configuration and availability of virtual machines offered in each cloud environment.
Cloud-based Attacks
The candidate will demonstrate an understanding of the tactics and techniques used to attack major cloud provider’s computing resources.
GCP and Google Workspace Cloud Platform Logging
The candidate will demonstrate an understanding of the information available from the generation, collection, retention and storage of logs from GCP and Google Workspace
GCP and Google Workspace Structure and Access Methods
The candidate will demonstrate an understanding of GCP and Google Workspace architectures, logging, data access and the investigative possibilities
In-Cloud Investigations
The candidate will demonstrate an understanding of how to collect forensic images and how to extract data from cloud resources to conduct forensic investigations.
Introduction to Enterprise Cloud Digital Forensics and Incident Response
The candidate will demonstrate an understanding of the most popular cloud concepts. The candidate will demonstrate an understanding of key cloud resources and logs used to facilitate incident response and forensics.
Multi-Cloud Virtual Networking
The candidate will demonstrate an understanding of each cloud networking topology and the grouping of resources for network communication. The candidate will demonstrate an understanding of the inspection and control of network traffic.
Other Popular Courses
Executive Cyber Risk Certification (ECRC)
- Duration: 2 Days
- Language: English
- Level: Intermediate
- Exam: ECRC
Mastering Communication & Presentation Te...
- Duration: 4 Days
- Language: Danish
- Level: Intermediate
- Exam: MCPT
Next Generation Mindfulness
- Duration: 1 Days
- Language: English
- Level: Foundation
- Exam: NGM