High severityHARDEC6 steps · 4 phases
Cloud Security Incident Response
Cloud environment incident response: IAM takeover, cryptomining, storage bucket exposure, cloud-native lateral movement. Source: NIST CSF 2.0 + AWS/Azure/GCP best practices.
Information note
Informational note: Cloud security investigations should be conducted close to the data; standing up the analysis environment in the same region as the cloud provider reduces data transfer costs and latency. IAM logs (CloudTrail, Entra Audit, GCP Audit Logs) are the first point of inspection; then move on to object storage access logs and network flow records. Pre-configure the cloud provider's incident response APIs and SOAR integrations to automate the response process.
1
Preparation
1 steps- Establish cloud IR capability
Enable CloudTrail/GuardDuty, Azure Defender/Activity Log, GCP SCC/Audit. IR IAM role for investigation. Cloud account + critical resource inventory.
2
Detection & Analysis
2 steps- Triage cloud alert
Classify incident type: IAM credential takeover, resource abuse, misconfiguration exploitation, insider, supply chain.
- Analyze cloud audit logs
CloudTrail/Activity Log: unauthorized API calls, anomalous AssumeRole, IAM policy changes, sensitive bucket GetObject, unexpected EC2 activity.
3
Containment, Eradication & Recovery
2 steps- Isolate compromised cloud identity
Revoke access key pair, disable IAM user/role, invalidate active sessions, remove attacker IAM policies.