Incident Response

This chapter helps readers to learn best practices that will help them define and implement their own security incident response plan for workloads in the AWS Cloud. It introduces a mental model that allows readers to assess how mature an incident response plan is. To complete the incident response maturity model, the evolution of an incident itself is considered: the incident lifecycle. The chapter also helps readers to learn how to react to well‐known security incidents that may happen in AWS Cloud. Different organizations may apply distinct reactions in case an Amazon EC2 instance is compromised by an installed malware. Regarding technology, AWS Cloud provides the tools to improve the effectiveness of an incident response plan. Arguably, one of the main factors that implies a more secure environment in the cloud is related to automation.