Internship← Cloud Security learning pathCloud Security · Module 9 of 10
Incident response in the cloud
Prepare for and handle cloud incidents.
📖 Key ideas
- Prepare playbooks for common incidents: leaked keys, public buckets, compromised accounts.
- Contain quickly: disable keys, isolate instances, revoke sessions.
- Preserve evidence: snapshots, logs.
- Eradicate and recover from clean, known-good infrastructure.
- Review lessons and improve controls.
💡 Real-life example: Cloud incident response is a fire drill for a skyscraper: everyone knows the exits before smoke appears.
PlaybookStep-by-step incident procedure
ContainmentStopping spread
SnapshotPoint-in-time copy of a disk
Lessons learnedPost-incident improvements