Certificate of Cloud Security Knowledge (CCSK v5) Study Guide

Chapter 11. Incident Response: From Detection to Recovery

In preparing for battle I have always found that plans are useless, but planning is indispensable.

Dwight D. Eisenhower

Incident response is the structured approach an organization takes to prepare for, detect, contain, and recover from cybersecurity incidents such as data breaches, malware infections, insider threats, or DoS attacks. Incident response must be planned before an incident occurs. Unfortunately, it is a matter of when, not if, an organization will experience a security incident and possibly a breach. These incidents and breaches can occur for numerous reasons, including accidental reasons.

While organizations likely have incident response plans for internal IT systems, the cloud introduces a new virtual environment that requires expert knowledge of incident response processes, tools and technologies, governance, and new complexity for every cloud platform used.

The CSA references several key tools for its incident response recommendations, including NIST SP 800-61 Rev. 2, the CSA Cloud Incident Response (CIR) framework, ISO/IEC 27035, and ENISA’s “Strategies for Incident Response and Cyber Crisis Cooperation” document. The CSA adapts these recommendations to reflect cloud-specific incident response challenges and processes.

This chapter identifies and explains best practices for incident response in the cloud. These can be used as a reference to develop an organization’s incident response architecture, plans, ...