Who Touched the Instance? Cloud Audit Logs and Chain of Custody

<p>Monday 09:10 at Udaan Wallet (fictional): the payments API server is stopped and its security group has a rule nobody remembers adding. The account's audit event history is your evidence.</p><p>In four lessons you learn how cloud audit logs record identity, source, user agent and outcome; how to pivot from a resource to an identity to a source; how to tell changes from reconnaissance and denied attempts; how to contain an incident without destroying evidence; and how to keep a chain of custody that would stand up with auditors or a regulator. You finish with the investigation note and custody record in the Word lab.</p><p>The event history is simulated, summarised as a defender sees it, and generated for you. Part of the Bartman Cybersecurity track (Professional Certificate in Cybersecurity, LSBF).</p>

Tools: Cloud forensics, CloudTrail, Incident response, Chain of custody, IAM keys