Baitaphish
Security intelligence
SearchLatest briefing
SCS-C03 · D2 · 14%

Incident Response

Prepare repeatable cloud incident procedures, preserve evidence, contain safely, eradicate causes, and restore trusted operation.

Provider facts checked 2026-08-03

Objective coverage

Objective 2.1 · high

Design and test an incident response plan

Define roles, access, evidence paths, automation guardrails, communications, exercises, and recovery criteria before an incident.

Lesson
d2-lesson
Practice pool
d2-questions
Application
scs-l03
Objective 2.2 · high

Respond to security incidents

Triage findings, preserve volatile evidence, contain with reversible actions, determine scope and root cause, and recover with validation.

Lesson
d2-lesson
Practice pool
d2-questions
Application
scs-l03, scs-l08

title: "Incident Response" summary: "AWS incident-response decisions that preserve evidence, contain safely, automate repeatable actions, and support recovery."

Decision frame

Cloud incident response preserves safety, evidence, reversibility, and business continuity while reducing attacker capability. Preparation matters because responders may need trusted access, clean tooling, cross-account visibility, and preapproved containment when the normal identity plane is suspect.

Prepare before the event

Define incident authority, communications, evidence ownership, time synchronization, forensic accounts, access paths, escalation, legal or privacy involvement, automation limits, recovery criteria, and exercise cadence. Pre-stage roles and tools without leaving broad standing access. Record which actions are reversible and which destroy volatile evidence.

Respond in order

  1. Validate the finding and establish a working timeline.
  2. Determine likely identities, accounts, Regions, resources, data, and dependencies in scope.
  3. Capture evidence proportionately before destructive change when safe.
  4. Contain with the narrowest reversible action that meaningfully reduces attacker capability.
  5. Remove persistence and root cause, then restore from a trusted state.
  6. Verify logging, controls, integrity, and business behavior before normal operation.
  7. Convert lessons into owned corrective action.

Quarantining a security group may isolate network traffic but does not revoke API credentials. Deleting a workload may destroy evidence without constraining the identity used to create another one. Rotating credentials without finding the source of exposure can leave the incident unresolved.

Self-check

Explain what you would preserve and what you would revoke first when a role session, an EC2 instance, and an S3 object all appear in the same incident timeline.