Cloud security incident management
Domain 6 tests incident management across organizational and provider boundaries. You must prepare, detect, respond, recover and learn, while preserving evidence and meeting notification duties.
Core rules and concepts
- Cloud incidents include account and API key compromise, misconfiguration, data exposure, ransomware, DDoS, provider outage and subprocessor breach.
- Define severity, roles, escalation, provider contacts, SLAs, communication and legal or regulatory notification.
- Contract for timely provider notification, log access, cooperation and forensic support.
- Containment may mean revoking keys, isolating workloads, disabling public access, rotating secrets or invoking provider support.
- Preserve logs and chain of custody; understand retention and jurisdiction before deleting resources.
- Post-incident review assigns corrective actions and updates risk, controls and awareness.
Worked example
A storage bucket exposes PII. Detect via alert, restrict public access, preserve access logs, rotate credentials, scope affected records, assess legal notification, inform the provider if a platform issue exists, then fix configuration and add preventive controls. Rushing to delete the bucket can destroy evidence.
Traps
Assuming the provider handles all incidents; no contractual notification; deleting logs; no test of contact paths; treating a provider outage as only an availability issue when data and notification duties may also arise.