Anti-ransomware strategies on the cloud
summary
Seven ransomware phases map to concrete AWS controls: reconnaissance blocked with CloudFront + WAF + Shield Advanced and rate/bad-IP/bot rules, initial access prevented by IMDSv2 enforced and eliminating static keys via IAM Roles/IRSA/IAM Roles Anywhere, detection via GuardDuty, Malware Protection for EC2, Route53 DNS Firewall and Security Hub aggregation, investigation with Detective, and recovery using automated EBS/S3 snapshots to a separate account and S3 Object Lock + RCP. More than 50% of incoming traffic is bots and object-level scans trigger automated quarantines.
AI-written summary · about
chapters (14)
- 0:00Introduction and welcome
- 1:52Ransomware trends and threats
- 6:10Reconnaissance phase strategies
- 9:58Initial access and privilege escalation
- 12:27Lateral movement and runtime monitoring
- 13:51Data exfiltration prevention
- 14:37Account lockout and ransom response
- 16:23Anti-ransomware walkthrough
- 21:20Prevention strategies and controls
- 23:27Detection and investigation tools
- 25:31Automated incident response
- 26:35Backup and recovery guidelines
- 26:55Case study: AnyCompany Fintech
- 29:43Summary and Q&A
related talks
50mProtegiendo sus datos en la nube de AWS ante un evento de ransomware
35mDefeating Ransomware Attacks
14mBehind the scenes w/ SentinelOne’s MDR: Detecting cloud ransomware
50mRansomware Readiness: Backup and Recovery in the Cloud
13mUsing AI to thwart cloud ransomware
38mRansomware and Backups: A Multi-Layered Defense Strategy
57mCloud security, data responsibility, and recovery: 10 key strategies
15mRansom Access Memories: Achieving Practical Ransomware Protection in Cloud with DeftPunk