Week 6: Responding to and Managing an Incident
Exploring incident and how to respond using AWS services like Config, Lambda, and GuardDuty using Industry best practices.
Series: AWS Cloud Security (6 articles)
- …
- 6Week 6: Responding to and Managing an Incident This article
Identifying an Incident
Incident response is a set of informtion security policies and procedures that you can use to identify, contain and eliminate cyber attacks. The goal of Incident response is to enable an organization to quickly detect and halt attacks, which helps to minimize damage and prevent future attacks of the same type.
Incident response has two phases and they include:
- Discovery and recognition Phase: This phase starts when the notiications is received, these noticifications are set up by users and it is initiated by specific alerts
Services that support the discovery and recognition phase include:
- AWS Trusted Advisor
- Amazon CloudWatch
- Amazon Inspector
- Amazon GuardDuty
- AWS Shield
- AWS Config
- Resolution and recovery phase: In this phase, when the issue has been discovered they perform certain operations and they include:
- Forensic Isolation: This involves isolating the issue and performing a deep diagnostics
- Staging a fix: This involves reproducing the issue, and applying a fix
- Deploying a fix
- Incident closure
Services that support the resolution and recovery phase include:
- AWS Systems Manager: is that service that gives you a centralized view of all your services. It gives you the ability to group resources by application, view operational data for monitoring and troubleshooting, and take action on your groups of resources. Systems Manager can help you to keep your instances in their defined state and perform on-demand changes, such as updating applications or running shell scripts.
- AWS CloudFormation: Helps you model and set up AWS resources so you can focus more time on the application running on AWS. One of the biggest perks of CloudFormation is reusability. Once CloudFormation templates are created and used, they can be reused, modified, and rolled back to previous versions. An enterprise can use CloudFormation to recreate a staging environment inside an isolated, or forensic, virtual private cloud (VPC). Once the system is isolated, the team can deep dive and discover the issue, possibly reproduce the issue, apply a fix, and test. Then, the team can push any new infrastructure as code or any new application code to production.
- Amazon Simple Notification Service (Amazon SNS): SNS is an event-driven web service that allows applications, end-users, and devices to instantly send and receive notifications from the cloud. In the context of security, SNS is useful for notifying security teams about security events and incidents. Interesting security workflows can also be built by integrating Lambda and SNS.
- AWS Step Functions: AWS Step Functions is a low-code, visual workflow service that developers use to build distributed applications, automate IT and business processes, and build data and machine learning pipelines using AWS services. Event-driven workflows manage failures, retries, parallelization, service integrations, and observability so that developers can focus on higher value business logic. When an enterprise experiences abnormalities, implementing Step Functions can help you to create complex business logic in event-driven workflows that connect services, systems, or people within minutes.
- AWS Lambda: Is a serverless, event-driven compute service that provides the ability to run code on demand without provisioning or managing servers. Lambda functions are stateless, with no affinity to the underlying infrastructure. This means that Lambda can rapidly launch as many copies of the function as needed to scale to the rate of incoming events.
Industry best Practices
Series: AWS Cloud Security (6 articles)
- …
- 6Week 6: Responding to and Managing an Incident This article
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article