Responding to Security Events

• Preserve evidence before you contain or clean up
• Capture memory before disk
• Isolate an instance with a no-rules security group plus a deny-all NACL
• A security group is stateful, so it won't drop an attacker's open session; a NACL will
• Containment, eradication, and recovery answer three different questions
• Recovery rebuilds from known-good, it does not un-isolate the compromised host
• GuardDuty detects, Security Hub aggregates, Detective investigates
• Use Amazon Detective to validate scope and find the root cause
• Detective finding groups cluster related findings into one incident
• Search and correlate logs in Security Hub, build automation there
• Revoke the role's sessions when instance credentials are used from outside
• Revoking sessions attaches AWSRevokeOlderSessions keyed on aws:TokenIssueTime
• A leaked long-term access key is deactivated and deleted, not revoked
• A compromised root needs password, keys, and MFA all rotated
• Store forensic evidence in a separate account
• Lock evidence write-once with S3 Object Lock compliance mode
• Automated Forensics Orchestrator runs the capture and isolation flow for you
• Eradication closes the entry point, not just the symptom
• EventBridge needs kms:GenerateDataKey + kms:Decrypt on the topic key to publish to an encrypted SNS topic
• A cross-account SNS/SQS subscriber on an encrypted topic must be granted KMS key permissions too
• Centralized remediation Lambda/runbook must assume a pre-created IAM role in each member account
• Query CloudTrail logs already in S3 with Amazon Athena to scope an incident fast
• A CloudTrail Lake organization event data store lets a delegated admin run SQL across all accounts
• CloudTrail Lake logs management events only until you add advanced event selectors for data events
• One-year extendable retention reaches ~10 years; constrain queries by eventTime to control cost
• Import or copy existing S3 trail logs into CloudTrail Lake to investigate past events
• Use an AWS Config aggregator advanced query to size an org-wide misconfiguration's blast radius
• AWS Config's configuration timeline links each change to the CloudTrail event and principal that made it
• A Detective investigation auto-generates a report of IoCs and MITRE ATT&CK TTPs for an IAM user or role
• Query Systems Manager Inventory (Windows update/registry types) to validate which hosts a finding really affects
• CloudTrail S3 data events arrive in ~5 minutes; S3 server access logs are best-effort and can lag hours
• Security Hub/GuardDuty findings carry ASFF resource details you pivot on to find all affected resources
• Share encrypted EBS snapshots to a forensic account by re-encrypting under a shared customer managed key

Unlock with Premium — includes all practice exams and the complete study guide.