/// đź”— Register for webcasts, summits, and workshops -
Demystifying AWS Incident Response: A Practical Perspective | I.R. Summit 2024
I would be speaking on how do we deal with exposed IAM access / secret keys incident scenerio, where keys were inadvertently pushed by a developer to public github respostitory. I will show screenshots containing practical from my lab setup on how do we configure AWS CLI, what attacker will do with these exposed keys (basically creating new temporary session tokens, etc.) and querying for resources available to this exposed keys. I will also talk about mitigation steps.
Then I will talk about EC2 instance compromise use case, how do we take EBS snapshot, how do we take memory snapshot, how do we isolate this instance using security groups, etc. How do we use systems manager to automate various aspects of this workflow.
At last, I would also talk about AWS Incident Response Framework available on github, what challenges it solve, how do we deploy it, what the architecture look like, etc. It should be ideally done in 25 minutes.
///Chapters
00:10 - whoami
00:36 - Agenda
01:32 - Cloud Security Incidents
04:10 - IR Lifecycle, Shared Responsibility Model
05:31 - AWS Services for Incident Response
05:51 - AWS CloudTrail
07:14 - VPC Flow Logs - similar to NetFlow
08:20 - AWS GuardDuty
09:30 - IR Playbook - Practical Examples
09:37 = Scenario #1 - IAM Credential Exposure
16:55 - Scenario #2 - Cryptojacking
25:37 - AWS IR Framework
26:45 - References, Contact Info
/// đź“„ View our Pay-What-You-Can Courses
/// đź“„ View the Antisyphon Course Catalog
/// đź“„ View Our Live Training Course Calendar
/// đź“„ Antisyphon Training Roadmap
///Antisyphon Socials
///Antisyphon Training
///Antisyphon Shirts
///Educational Infosec Content
///Backdoors & Breaches - Incident Response Card Game
Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest:
https://wildwesthackinfest.com/ #bhis #antisyphon #infosec #CyberSecurity #training