CCSK · Domain 7
Security Monitoring, Incident Response and Resilience
About 12% of the exam
Cloud telemetry sources
- Management plane log
- every administrative call recorded
- Data plane log
- reads and writes to data
- Network flow log
- connections between workloads
- DNS query log
- names the workload resolved
- Identity log
- sign-ins, elevation and failures
- Application log
- what the code itself did
- Configuration history
- state of resources over time
- Provider health
- outages affecting your service
Forward management plane logs into a separate account so an attacker who owns the workload cannot rewrite the record
Log architecture
- A central account owns the archive
- Write once storage for retention
- Normalize timestamps to one zone
- Common schema across every provider
- Short native retention needs export
- Access to logs is itself privileged
- Alert when logging configuration changes
Detection approaches
- Signatures catch what is already known
- Behavioral baselines catch the unknown
- Identity anomalies matter most in cloud
- Correlate identity with resource activity
- Threat intelligence enriches raw events
- Attack path analysis prioritizes exposure
Alert quality
- Threshold and aggregation reduce noise
- Enrich with owner and criticality
- Suppress the benign, keep the detector
- Every alert needs a runbook
- Measure the false positive rate
- Tune before adding more rules
Incident lifecycle
- Prepare
- Detect and analyze
- Contain
- Eradicate
- Recover
- Post incident review
Eradication removes the cause while containment only stops the bleeding, so do not confuse the two under pressure
Cloud specific containment
Identity
- Rotate the credential immediately
- Revoke sessions already issued
- Hunt for persistence the key created
Compute
- Isolate with a deny policy
- Snapshot before you change anything
- Scale the malicious function to zero
Data
- Disable the key, never delete
- Freeze the storage with a lock
- Revoke public sharing links
Investigation in cloud
- Snapshots replace physical disk imaging
- Memory disappears when the instance stops
- Console retention is often too short
- Query exported logs, not the console
- Record custody for anything evidential
- Agree provider assistance before you need it
Multi-cloud operations
- Normalize telemetry into one schema
- Cross-provider movement hides in silos
- One playbook, provider specific steps
- Consistent severity across every platform
- Central identity simplifies correlation
- Different providers, different log latency
Resilience concepts
- Recovery time objective
- how long the outage may last
- Recovery point objective
- how much data may be lost
- Business impact analysis
- which processes matter and why
- Concentration risk
- one provider carries everything
- Synchronous replication
- no loss, distance limited
- Asynchronous replication
- lag means some loss
- Failover testing
- unvalidated objectives are guesses
- Dependency mapping
- keys, secrets, naming and identity
Continuity planning
- Plan for account loss, not only outage
- Billing failure can end a service
- Keep a copy outside the provider
- Recovery needs its own credentials
- Restore order follows the dependency map
- Exercise the plan on a schedule
Immutability and recovery
- Locked storage resists administrator deletion
- Backups in a separate trust domain
- A restore point may contain the intruder
- Validate before returning to production
- Rebuild from pipeline, not from backup
- Rotate secrets after every recovery
Operations failures
- Logs deleted along with the workload
- Detection switched off to stop noise
- Recovery plan depends on the failed region
- No owner for the alert queue
- Dwell time measured in months
Rapid recall: operations picks
- Telemetry quietly weakened
- alert on logging changes
- No data loss allowed
- synchronous replication
- Console retention too short
- export to a log archive
- Ransomware reaching backups
- immutable locked storage
- Cross-provider attack path
- normalized central logging
- Stolen temporary session
- deny by token issue time
- Untested recovery objective
- run a failover exercise
- Alert fatigue
- aggregate and suppress benign
Reference strip: telemetry, architecture, detection, response, resilience
Telemetry
- Management and data plane
- Flow and name resolution logs
- Identity and application events
- Configuration history over time
Architecture
- Separate log archive account
- Write once retention
- Common schema and timestamps
- Alert on logging changes
Detection
- Signatures plus behavior baselines
- Identity anomalies first
- Enrichment before triage
- A runbook per detection
Response
- Contain then eradicate
- Snapshot before changing
- Disable keys, never delete
- Blast radius limited by design
Resilience
- Objectives agreed and tested
- Dependencies mapped and recovered
- Immutable copies held apart
- Plan for provider loss
Quick exam traps
- Trap: Rotating the stolen key completes the containment
- Trap: The provider console holds enough history for an investigation
- Trap: Asynchronous replication gives a recovery point objective of zero
- Trap: Restoring the most recent backup returns a clean environment
- Trap: A tested backup makes a failover test unnecessary
- Trap: Deleting the compromised resource is the fastest way to close it
- Trap: One provider with many regions removes concentration risk
cybercertprep.com · original revision sheet written from the public body of knowledge