Incident Response & Resilience
Plan for the cloud you have
The incident response lifecycle is preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Cloud changes the mechanics: you cannot unplug a disk, instances may be terminated by an attacker or by an autoscaler, and scope spans accounts, regions, and provider status events. Preparation includes pre-authorized forensic accounts and snapshot permissions, named provider contacts, and log retention that outlives the incident.
Forensics challenges
Shared tenancy means no access to the physical layer, and volatile evidence disappears the moment an instance stops. Investigators rely on API and audit logs, disk snapshots, in-guest memory capture, and provider cooperation under contract. Jurisdiction and chain of custody still apply, and data may sit in several regions at once.
Resilience
Recovery time and recovery point objectives drive design. Distinguish backups from snapshots, from multi-zone replication, from multi-region architectures. Multi-zone failover delivers availability, not backup: deletion, corruption, and ransomware replicate happily. Provider disaster recovery covers provider infrastructure, not your data or configuration. Test restores and rehearse under realistic conditions.
Traps
- High availability is not a backup strategy.
- Snapshots must be consistent and stored where you can actually restore them.
- The provider's incident response plan is not your incident response plan.
- Auto-scaling and self-healing can undo containment actions.
Rule of thumb
Contain by identity and network first (revoke credentials, apply deny policies, isolate the subnet), then preserve evidence, then rebuild from trusted code.