Imagine I'm sitting in AWS or Azure, what can you do?
We can image a lot of those.
They have virtual block devices, and we can go in and grab those,
and pull those images down.
It takes a lot longer because we're pulling an image over the internet,
and you set up a secure tunnel on one side,
secure tunnel on the other side,
and you run some commands that will make a forensic image.
But a lot of times,
we have to do things like logical captures where we're just getting the data as
it sits from the web route and looking through that code.
Do you still get stuff, because I'm not an expert at this,
do you still get stuff, like the free space and deleted files,
from those cloud images?
Not as much.
Again, if you can get a virtual block device,
you can get virtual deleted space, or unallocated space.
Slack space you can get if you're pulling an image.
But if you're doing a logical capture, you're just getting the files.
So you're losing some forensic abilities there.
Is that a problem for you now in your industry?
Not so much since we've seen the attacks moving more to the client side.
We saw credit cards being hidden in unallocated space more on
the server side where the attacker has greater control over
the kernel or over the web server.
Then they would try to hide data in those more sophisticated ways.
With the client-side attacks, we usually find those,
and we find the attack is revealed in the logical capture of the data.
From my perspective, if I was the criminal, the server-side attack's hard.
The client-side attack's easy.
I don't require persistent.
I'm less likely to get detected.
Why would anyone do a server-side attack anymore,
especially now that everyone's seen how to do client-side attacks really well?
If you can still pull off a server-side attack,
you can hide yourself very, very well.
And so the persistence that you can maintain on a user's website
is far greater than if you were relying on a third-party code
that may not be there in two weeks.
So a sophisticated attack is to go server side,
less sophisticated attack is go client side.
Client side, we're seeing a lot more surface area for the attackers to hit.
On server side,
they're really depending on the merchant not being in PCI compliance
to pull off a sophisticated server-side attack.