Cloud incident response: what changes when you do not own the host