AWS Security · Domain 2
Incident Response
About 14% of the exam
The response lifecycle in AWS
- Prepare
- Detect
- Contain
- Eradicate
- Recover
- Learn
- Prepare
- accounts, roles, runbooks, drills
- Detect
- GuardDuty, Security Hub, EventBridge
- Contain
- isolate, revoke, snapshot, freeze
- Eradicate
- remove persistence and root cause
- Recover
- rebuild from known good images
- Learn
- control gap feeds back to preparation
Response in AWS is API driven, so containment is a policy change and a snapshot rather than a cable pull
Contain a compromised instance
- Do not power it off yet
- Swap to an isolation security group
- Deny all inbound and outbound
- Detach from the Auto Scaling group
- Snapshot EBS volumes before changing anything
- Capture memory before you stop it
- Tag the instance as quarantined
- Preserve the instance profile evidence
Contain a compromised identity
- IAM user keys
- deactivate, then rotate and delete
- Role sessions
- deny on aws:TokenIssueTime cutoff
- Trust policy
- remove the allowed principal
- Console password
- reset and force MFA
- Key rotation
- add second key, verify, remove
- Root user
- enable MFA, delete access keys
- Federated user
- disable at the identity provider
Contain other resource types
- Lambda
- set reserved concurrency to zero
- S3 bucket
- Block Public Access, tighten policy
- ECS Fargate task
- stop the task, keep logs
- RDS
- revoke grants, restrict security group
- KMS key
- disable, never schedule deletion
- Container image
- quarantine tag, block admission
- EKS pod
- restrictive network policy, cordon node
Forensic acquisition
- Snapshot the EBS volume first
- Copy the snapshot to forensics
- Re-encrypt with the forensics KMS key
- Attach the copy in an isolated VPC
- Never mount evidence as writable
- Hash artifacts and record custody
- GuardDuty malware scanning is agentless
The forensics account pattern
Isolation
- Separate account, separate credentials
- Clean room VPC without internet egress
- Endpoints only for needed services
- Responder role assumed just in time
Evidence
- Snapshots copied, never moved
- Object Lock on the evidence bucket
- CloudTrail digest files prove integrity
- Chain of custody per artifact
Automation
- EventBridge starts a Step Functions flow
- Lambda applies the isolation security group
- Make every step idempotent
- Incident Manager pages the responder
Automating the response
Trigger
- GuardDuty or Security Hub finding
- EventBridge pattern on finding type
- Config rule non-compliance event
- CloudTrail event such as StopLogging
Act
- Lambda for a single step
- Step Functions for multi-step flows
- Systems Manager Automation runbooks
- Retry with backoff, catch failures
Tell
- SNS topic for the on-call
- Incident Manager response plan
- Chatbot into Slack or Chime
- Ticket created from the finding
Logs that answer the question
- CloudTrail
- which principal called which API
- VPC Flow Logs
- who talked to whom
- Resolver query logs
- domains the instance resolved
- S3 data events
- object level reads and writes
- ELB access logs
- request level web traffic
- EKS audit logs
- Kubernetes API activity
- Config timeline
- configuration before and after
Recovery and hardening
- Rebuild rather than clean in place
- Patch the gap before restoring service
- Backups may carry the same foothold
- Rotate every secret the host held
- Verify no leftover roles or keys
- Restore from immutable backup copies
- Watch closely after returning to service
Guardrails that protect responders
- SCP denies deleting the GuardDuty detector
- SCP denies stopping CloudTrail logging
- MFA Delete on versioned log buckets
- Object Lock on the evidence archive
- Backup Vault Lock resists deletion
- Break glass role kept out of scope
Communication and after action
- Separate technical and executive channels
- One incident commander at a time
- Record decisions with accurate timestamps
- Blameless review focused on control gaps
- Measure time to detect and contain
- Feed lessons back into runbooks
Know the order
- Preserve
- Isolate
- Investigate
- Eradicate
- Rebuild
- Review
Preserve before you isolate, isolate before you investigate, and never rebuild onto the same gap
Rapid recall: containment moves
- Leaked access key
- deactivate then rotate
- Stolen role session
- token issue time deny
- Malicious Lambda
- reserved concurrency zero
- Public bucket
- account Block Public Access
- Flood at the edge
- Shield Response Team plus WAF
- Key pending deletion
- call CancelKeyDeletion now
- Compromised container
- stop task, keep the logs
Reference strip: prepare, detect, contain, investigate, recover
Prepare
- Separate security and log accounts
- Pre-created responder roles
- Runbooks tested by tabletop
- Forensics VPC and tooling ready
Detect
- GuardDuty findings into EventBridge
- Security Hub as one queue
- Alarms on logging changes
- Root sign-in alerting
Contain
- Isolation security group
- Revoke sessions by issue time
- Reserved concurrency zero for Lambda
- Quarantine tags drive automation
Investigate
- Detective behavior graph
- Athena over CloudTrail in S3
- Flow Logs for the egress path
- Snapshot copies in forensics
Recover
- Rebuild from a known good image
- Rotate every exposed secret
- Close the control gap first
- Post incident review and metrics
Quick exam traps
- Trap: Stopping a compromised instance is the correct first containment step
- Trap: Deleting an IAM access key immediately kills the role sessions it started
- Trap: Scheduling the KMS key for deletion is a safe containment action
- Trap: Restoring the newest backup is enough to eradicate an intrusion
- Trap: An archived GuardDuty finding will never resurface for that activity
- Trap: Forensic copies can stay in the compromised account as long as they are tagged
- Trap: A NAT gateway masks the source, so VPC Flow Logs cannot show the exfiltration
cybercertprep.com · original revision sheet written from the public body of knowledge