How Security Incidents Are Different ... and How They're Exactly the Same
summary
Scenario shows an SSO phishing proxy that yields AWS access, attacker downloads S3 data and demands crypto, detection often misses it until a ransom letter, and cleanup takes weeks. Investigation relies on CloudTrail and EDR logs plus deep application logs, teams must rotate creds, hunt lateral movement, and confirm backups aren’t tainted. Legal imposes legal privilege and need‑to‑know rules that limit postmortem sharing, so organizations invest in centralized logging pipelines and shared response tooling and still find detection and disclosure practices frequently failing.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 4:11Defining security incidents
- 7:24Attacker access tactics
- 10:32Initial response steps
- 13:39Legal considerations
- 16:46Threat actor eviction
- 19:12Cross-team coordination
- 22:03Why incidents linger
- 25:08Communication pitfalls
- 27:38Postmortems under constraints
- 30:05Engineer tips
- 33:56SRE and security response
- 37:03Key takeaways
related talks
16mLessons from the SOC: Analyzing and remediating cloud attack paths
55mStreamline security analysis with Amazon Detective
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
54mSOCcing: Responding to a Cyber Incident
20mFantastic AWS Attacks and Where to Find Them
28mPatterns for scalable security detections on AWS
40mFighting Financial Crimes as an SRE
18mHow AWS Partners use observability to strengthen customer security