Question

A financial services company running its trading platform in a public IaaS environment discovers evidence of a potential insider fraud incident. Legal counsel instructs the cloud security team to preserve all relevant digital evidence for a possible court case. Some critical evidence resides in provider-managed logs (e.g., hypervisor and storage-layer activity) that the customer cannot directly access. What is the MOST appropriate action for the security team to ensure this evidence is admissible and properly preserved?

Accepted Answer

Submit a formal evidence preservation request to the cloud provider through the contractually defined channel and document the request as part of the chain-of-custody record

Answer

Immediately reimage the affected virtual machines to capture a clean forensic snapshot before the attacker can cover their tracks

Answer

Rely solely on the customer-accessible application logs, since provider-managed logs are not legally usable in court

Answer

Publicly disclose the incident to regulators before consulting legal counsel to demonstrate good-faith transparency