- The document discusses strategies for both before and after a security breach occurs. - Before a breach, the key recommendations are to adopt resilient design patterns like limiting credential reuse, isolating applications, and continuously snapshotting configurations. Critical logs should also be collected and stored immutably outside the environment. - After a breach is discovered, the document advises cutting connections but also considers briefly observing the attacker first to understand the full scope. Isolating compromised infrastructure and practicing incident response drills are also suggested.

1. ALERT LOGIC
Surviving The Breach
Misha Govshteyn
Founder & Chief Security Officer

2. BEFORE THE
BREACH

3. Macro Trends: Significant increase in web app attacks

4. Macro Trends: Credentials are the weakest point

5. Adopt design patterns optimized for resiliency
• Get involved at design stage
• Limit blast radius of the breach to
constrain lateral movement
- Limit use/reuse of credentials
- Isolate applications
• Be prepared
- Continuously snapshot configuration state
- Configure IR specific accounts or keys
- Install IR tools in your base images and
enable automated collection
- Make sure you understand your own logs

6. Collect investigation data before the breach
• Establish normal log patterns prior
to breach
• Ensure logs are immutable –
stored outside of your
environment, unable to be deleted
or modified by attackers
• You’re ready when your logs are:
- Easily accessible
- Searchable
- Cloud aware
- Continuously monitored
AWS CloudTrail
AWS Config
System & App logs
Network Telemetry

7. AFTER THE
BREACH

8. Step 1: Cut the cord as soon as possible
well… maybe…
Actually, Give It a Minute or Two

9. Downside of moving too fast

10. Before you act, ask yourself:
• Do you really care about exposing
the data on breached systems?
• What is your primary objective?
• Is there a downside to quietly
observing the actions of the
attacker?

11. Downside of uncertainty

12. Deployment & Management
Impact Largely Depends on Environment & Data
security group
Development
Production

13. What happens when developers are breached

14. Be prepared when it matters most
• Assume that at some point you will be breached
• Operate from snapshots whenever you can
• If possible, observe your adversary without tipping them off to
understand full extent of the breach and attacker intent
• Use cloud networking tools to isolate compromised infrastructure
and orchestrate recovery efforts
• Run your incident response team through regular, unannounced
drills

15. Thank you.
misha@alertlogic.com Twitter: @mgbits