I85PREP
⌘ K
ECIH study materials
ECIH study resources

ECIH: Handling and Responding to Cloud Security Incidents

ECIH · Work through your exam, one topic at a time.

All guide sections

Handling and Responding to Cloud Security Incidents

Start with the shared responsibility model

In IaaS the provider secures the physical layer, hypervisor and network fabric; the customer secures the OS, applications, identity and data. In PaaS more shifts to the provider; in SaaS the customer typically owns only identity, configuration and data. Exam traps: assuming the CSP handles patching of your VMs, or assuming you have no duty in SaaS. Answer honestly per service model.

Typical cloud incidents

Publicly exposed storage buckets/blobs, leaked API keys and access tokens in repositories, account hijacking via consented OAuth apps or stolen credentials, cryptojacking (sudden compute spend), data exfiltration, misconfigured security groups, and malicious insiders in SaaS tenants.

Evidence sources

Provider audit logs (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs), VPC Flow Logs, S3/blob access logs, identity provider sign-in logs, CASB, cloud-native SIEM, and workload logs. Remember the cloud-specific difficulties: no physical access, jurisdictions and data-residency law, ephemeral instances that vanish on termination, and short default log retention - some logs roll off in days, so export to immutable storage first.

Response sequence

  1. Preserve: export/copy logs and snapshot volumes and memory-adjacent state before terminating anything.
  2. Contain: revoke sessions and refresh tokens, disable or rotate compromised access keys, attach a restrictive security group/quarantine network, disable the OAuth consent grant, isolate the subscription or account.
  3. Eradicate: remove the malicious workload, fix the IAM policy, close the public bucket, remove persisted backdoors (extra keys, IAM users, Lambda functions, webhooks).
  4. Recover: redeploy from trusted IaC, verify, monitor billing and identity anomalies.
  5. Lessons learned: least privilege, MFA, key rotation, cloud posture management.

Rule of thumb: in the cloud, identity is the new perimeter - always check for additional access keys, roles, service principals and OAuth grants the attacker may have created.