Conducting incident response (IR) in a public cloud is the same but different. IR on servers is not new and the public cloud is just other people’s servers; however, the “other people’s” part changes things a bit. This session will discuss public cloud incident response in which “they” handle the hypervisor and below and you handle the kernel on up.