AWS re:Invent 2015 | (SEC308) Wrangling Security Events in The Cloud

Have you prepared your AWS environment for detecting and managing security-related events? Do you have all the incident response training and tools you need to rapidly respond to, recover from, and determine the root cause of security events in the cloud? Even if you have a team of incident response rock stars with an arsenal of automated data acquisition and computer forensics capabilities, there is likely a thing or two you will learn from several step-by-step demonstrations of wrangling various potential security events within an AWS environment, from detection to response to recovery to investigating root cause. At a minimum, show up to find out who to call and what to expect when you need assistance with applying your existing, already awesome incident response runbook to your AWS environment.

[DougToppin]

Excellent overview in general but particularly liked the incident response (IR) example at around the 39 minute mark. I also liked the statement "There are two ways to get more practice in incident response: you only get to choose one".

[sachindagar]

Loved the presentation. The Security Geek is a funny guy. Kudos!