# Security Incident Response Runbooks in AMS Security Incident Response Runbooks This section contains two runbooks: + [Response to root user activity](sir-root-user.md) + [Response to malware events](sir-malware.md) # Response to root user activity Response to root user activity The  [root user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html) is the superuser within your AWS account. Note that AMS monitors root usage. It's a best practice to use the root user only for the few tasks that require it, such as to change your account settings, activate AWS Identity and Access Management (IAM) access to billing and cost management, change your root password, and turn on multi-factor authentication (MFA). For more information, see  [Tasks that require root user credentials](https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html#aws_tasks-that-require-root). For more information on how to inform AMS of planned root usage, see [When and how to use the root account in AMS](https://docs.aws.amazon.com/managedservices/latest/userguide/how-when-to-use-root.html). When root user activity is detected, either failed attempts to login that might indicate a brute force attack or activity in the account after a successful login, an event generates and an incident sent to your defined security contacts. AWS Managed Services Operations investigates unplanned root user activity, perform data collection, triage and analysis, and perform containment activities at your direction, followed by post event analysis. If you have the AMS Advanced operating model, you receive additional communications from AMS CSDM and AMS Ops engineers that confirm unplanned root user activity due AMS's responsibility to secure root user credentials. AMS investigates root user activity until you confirm a path forward. ## Prepare Prepare Advise AMS of any planned use of root user by submitting an AMS service request with data and times of planned event to prevent unnecessary incident response activities. Periodically conduct GameDays with AMS to validate AMS's customer incident response processes, people and systems are current, and build muscle memory with responsible individuals to achieve faster incident response. ## Phase A: Detect Phase A: Detect AMS monitors for root activity in the accounts through detection sources including GuardDuty and AMS monitoring. If you have AMS Accelerate, the operating model responds to the incident requesting investigation for unexpected root user activity. When this occurs, AMS Operations initiates the Compromised Account runbook. If you have AMS Advanced, the operating model responds to the incident, or informs the CSDM of any planned root user activity to terminate an active Account Compromise investigation. ## Phase B: Analyze Phase B: Analyze AMS performs a thorough investigation of the root user events when it's determined that the activity isn't authorized. Using both automations and AMS security response team, logs and events are analyzed for anomalies and unexpected behavior for root users. Logs are provided to you to help determine if the activity is unknown, or if it's an authorized root user event, or if it requires further investigation. Some examples of the information provided during the investigation to support internal checks includes: + Account information: What account was the root account used on? + E-mail address for root user: Each root user is associated with an e-mail address from your organization + Authentication details: Where and when did the root user access your environment from? + Activity records: What did the user do when logged in as root? These records are in the form of CloudWatch events. Understanding how to read these logs aids in investigation. It's a best practice that you are prepared to receive the analysis information and have a plan for how to reach authorized points of contact for accounts within your organization. Because root users aren't named as individuals, determining who has access to the root e-mail address used for the account within your organization helps to quickly route questions internally. ## Phase C: Contain and Eradicate Phase C: Contain and Eradicate AMS partners with your security teams to perform containment at the direction of your authorized Customer Security contacts. Containment options include: + Rotating appropriate credentials and keys. + Terminating active sessions to accounts and resources. + Eradicating resources created. During the containment activities AMS works closely with your security team to ensure any disruption to your workloads are minimized and the root credentials are appropriately secured. After the containment plan is completed, you work with AMS Operations team for any recovery actions as required. ## Post Incident Report Post Incident Report As required, AMS initiates the investigation review process to identify any lessons learned. As part of completing a COE, AMS communicates any relevant findings to affected customers to help them improve their incident response process. AMS documents all final details of the investigation, collects appropriate metrics, and then reports the incident to any AMS internal teams that require information, including your assigned CSDM and CA. # Response to malware events Response to malware events Amazon EC2 instances are used to host a variety of workloads including third-party software and custom-developed software deployed by application teams within organizations. AMS provides and encourages you to deploy your workloads on images that are patched and maintained on an ongoing basis by AMS. During the operation of instances, AMS monitors for anomalies in behavior or activity through a variety of security detection controls, including Amazon GuardDuty, Network Traffic, and Amazon internal Threat Intelligence feeds. AMS also monitors GuardDuty Malware Findings. These are available on both AMS Advanced and AMS Accelerate, if enabled. See [Malware Protection in Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) for more information. **Note** If you opted for [Bring Your Own EPS](https://docs.aws.amazon.com/managedservices/latest/userguide/ams-byoeps.html), then the process for incident response differs from what's outlined on this page. For more information, see the referenced documentation. When malware is detected, an incident is created and you are notified of the event. This notification is followed by any remediation activities that occurred. AMS Operations investigates, performs data collection, triage and analysis, and then performs containment activities at your direction, followed by post event analysis. ## Phase A: Detect Phase A: Detect AMS monitors for events on instances with GuardDuty. AMS determines the appropriate enrichment and triage activities to help you make containment or risk acceptance decisions based on the finding or alert type. Data collection is performed based on the finding type. Data collection involves querying multiple data sources both inside and outside of the affected account to build a picture of the activity observed or the configurations of concern. AMS performs correlation of the finding with any other alarms and alerts or telemetry from any impacted accounts or AMS threat intelligence platforms. ## Phase B: Analyze Phase B: Analyze After data is collected, it's analyzed to identify any activity or indicators of concern. During this phase of the investigation, AMS partners with you to integrate business and domain knowledge of the instances and workloads to help understand what's expected and what's out of the ordinary. Some examples of the information provided during the investigation to support internal checks includes: + Account Information: What account was the malware activity observed on? + Instance Details: What instance(s) are implicated with the malware events? + Event timestamp: When did the alert trigger? + Workload Information: What is running on the instance? + Malware details, if relevant: Families of malware and Open Source information about the malware. + Users or Role Details: What users or roles are affected by and involved in the activity? + Activity Records: What activities are recorded on the instance? These are in the form of CloudWatch events, and system events from the instance. Understanding how to read these logs will aid you in investigation + Network Activity: What endpoints are connecting to the instance, what the instance is connecting to, and what is the traffics analysis? It's a best practice to be prepared to receive investigation information, and have a plan about how to contact the appropriate points of contact for accounts, instances and workloads within your organization. Understanding your network topology and expected connection can help accelerate impact analysis. Knowledge of planned penetration testing in the environment and recent deployments performed by application owners can also speed up the investigation. If you determine that the activity is planned and authorized, then the incident is updated and the investigation ends. If compromise is confirmed, then you and AMS determine the appropriate containment plan. ## Phace C: Contain and Eradicate Phase C: Contain and Eradicate AMS partners with you to determine appropriate containment activities based on the data collected and information known. Containment options include but are not limited to: + Preserving data through snapshots + Modifying network rules to limit traffic in or out of instances + Modifying SCP, IAM user and role policies to limit access + Terminating, Suspending or Turning off Instances + Terminating any persistent connections + Rotating appropriate credentials/keys If you opt to perform eradication activity against the instance, then AMS supports you in achieving this. Options include, but are not limited to: + Removing any unwanted software + Rebuilding the instance from a clean fully patched image and redeploying applications and configuration + Restoring the instance from a previous backup + Deploying applications and services on to another instance within your account that might be suitable to host the workloads. It's important to determine how the malware was delivered and run on the instance before restoration of service to make sure that any additional controls are applied to prevent reoccurrence of the malware on the instance. AMS provides additional insights or information to your forensics partners or teams as necessary to support forensics. At this point, you work with AMS Operations for the recovery activities. AMS works closely with you to minimize disruption to the workloads and secure the instances. ## Post Incident Report Post Incident Report As required, AMS initiates the investigation review process to identify lessons learned. As part of completing a COE, AMS communicates relevant findings to you to help you improve your incident response process. AMS documents the final details of the investigation, collects appropriate metrics, and reports the incident to AMS internal teams that require information, including your assigned CSDM and CA.