Incident Response in AWS

For your journey with AWS, it is important for you to know about the fundamental security incident response concepts for your Cloud environment. You can join the accessible controls, cloud capabilities, and remediation alternatives, to help you improve the security of your cloud infrastructure. For all this, you should be familiar with the general principles of information security, have a basic understanding of incident response, and have some familiarity with Cloud services.

Not only the security staff but all the users of AWS within an organization should be aware of basic security incident response processes. The security staff must deeply understand how to mitigate security issues. Before handling a security event, experience and education are vital. As an AWS customer, be assured that your infrastructure on the Cloud is secure as security at AWS is the highest priority. You have access to hundreds of features and tools that help you in meeting your security requirements. AWS shared responsibility model provides you control over security policies implementation; you can easily establish a security baseline for your applications running in the cloud. If a deviation from your baseline occurs for any reason such as misconfiguration, you might need to respond and investigate and for that, you need to understand the basic concepts of security and incident response within your AWS environment.

The foundation of building a security incident response program on the cloud consists of four components.

Educate:
Your security operations team and incident response staff must know the cloud technologies and should have an understanding of how your organization is planning to use them.

Prepare:
Your incident response team should be able to detect and respond to incidents in the cloud. There should be runbooks in place for reliable and consistent responses.

Simulate:
To understand the effectiveness of your preparation, perform simulations of both expected and unexpected events inside your cloud environment.

Iterate:
Perform simulations regularly to improve the scale of your response posture, reduce time to value, and further reduction of risks.

AWS shared responsibility model educates you about your responsibilities for securing your cloud environment. Security of the cloud is the responsibility of AWS while you are responsible for what is inside the cloud. You have to place security controls in order to make your cloud environment secure according to your desire. Following is the AWS shared responsibility model defined in a picture to provide you a better understanding of your responsibilities when dealing with an incident.