Conclusion - AWS Security Incident Response User Guide

Conclusion

Each operations phase has unique goals, techniques, methodologies, and strategies. Table 4 summarizes these phases and some of the techniques and methodologies covered in this section.

Table 4 – Operations phases: Goals, techniques, and methodologies

Phase Goal Techniques and methodologies
Detection Identify a potential security event.

  • Security controls for detection

  • Behavior and rule-based detection

  • People-based detection

Analysis Determine if the security event is an incident and assess the scope of the incident.

  • Validate and scope alert

  • Query logs

  • Threat intelligence

  • Automation

Containment Minimize and limit the impact of the security event.

  • Source containment

  • Technique and access containment

  • Destination containment

Eradication Remove unauthorized resources or artifacts related to the security event.

  • Compromised or unauthorized credential rotation or deletion

  • Unauthorized resource deletion

  • Malware removal

  • Security scans

Recovery Restore systems to a known good state and monitor these systems to ensure the threat does not return.

  • System restoration from backups

  • Systems rebuilt from scratch

  • Compromised files replaced with clean versions