Demystifying AWS Incident Response: A Practical Perspective | I.R. Summit 2024
/// 🔗 Register for webcasts, summits, and workshops -
https://blackhillsinfosec.zoom.us/ze/...
Demystifying AWS Incident Response: A Practical Perspective | I.R. Summit 2024
I would be speaking on how do we deal with exposed IAM access / secret keys incident scenerio, where keys were inadvertently pushed by a developer to public github respostitory. I will show screenshots containing practical from my lab setup on how do we configure AWS CLI, what attacker will do with these exposed keys (basically creating new temporary session tokens, etc.) and querying for resources available to this exposed keys. I will also talk about mitigation steps.
Then I will talk about EC2 instance compromise use case, how do we take EBS snapshot, how do we take memory snapshot, how do we isolate this instance using security groups, etc. How do we use systems manager to automate various aspects of this workflow.
At last, I would also talk about AWS Incident Response Framework available on github, what challenges it solve, how do we deploy it, what the architecture look like, etc. It should be ideally done in 25 minutes.
///Chapters
00:10 - whoami
00:36 - Agenda
01:32 - Cloud Security Incidents
04:10 - IR Lifecycle, Shared Responsibility Model
05:31 - AWS Services for Incident Response
05:51 - AWS CloudTrail
07:14 - VPC Flow Logs - similar to NetFlow
08:20 - AWS GuardDuty
09:30 - IR Playbook - Practical Examples
09:37 = Scenario #1 - IAM Credential Exposure
16:55 - Scenario #2 - Cryptojacking
25:37 - AWS IR Framework
26:45 - References, Contact Info
/// 📄 View our Pay-What-You-Can Courses
https://www.antisyphontraining.com/pa...
/// 📄 View the Antisyphon Course Catalog
https://www.antisyphontraining.com/co...
/// 📄 View Our Live Training Course Calendar
https://www.antisyphontraining.com/tr...
/// 📄 Antisyphon Training Roadmap
https://www.antisyphontraining.com/tr...
///Antisyphon Socials
Twitter: / antisy_training
Mastodon: https://infosec.exchange/@Antisy_Trai...
LinkedIn: / antisyphon-training
Discord: / discord
///Antisyphon Training
Pay What You Can: https://www.antisyphontraining.com/pa...
Live Training: https://www.antisyphontraining.com/tr...
On Demand Training: https://www.antisyphontraining.com/on...
///Antisyphon Shirts
https://spearphish-general-store.mysh...
///Educational Infosec Content
Black Hills Infosec YouTube: / blackhillsinformationsecurity
Black Hills Infosec Blogs: https://www.blackhillsinfosec.com/blog/
Wild West Hackin' Fest YouTube: / wildwesthackinfest
Active Countermeasures YouTube: / activecountermeasures
///Backdoors & Breaches - Incident Response Card Game
Backdoors & Breaches: https://www.backdoorsandbreaches.com/
Play B&B Online: https://play.backdoorsandbreaches.com
Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: https://wildwesthackinfest.com/
#bhis #antisyphon #infosec #CyberSecurity #training