Threat Hunting in the Cloud

CHAPTER 6AWS Cloud Threat Prevention Framework

What's in This Chapter

• Using the AWS Well-Architected Framework
• Using the Shared Responsibility Model
• Using AWS Services for monitoring, logging, and alerting
• AWS Protect Features
  • How do you use Information Protection and Data Classification?
  • How do you prevent Initial Access?
• AWS Detection Features
  • How do you detect Privilege Escalation?
  • How do you detect credential access?
  • How do you detect lateral movement?
  • How do you detect Command and Control?
  • How do you detect data exfiltration?
• AWS Response and Recover Features
  • How do you create automated response?
  • How do you orchestrate and recover?
• How do you use machine learning and artificial intelligence?

This chapter focuses on using AWS services for various cloud threat protection in alignment with MITRE ATT&CK Framework.

Introduction to AWS Well-Architected Framework

The AWS Well-Architected Framework encapsulates a set of principles, processes, and best practices to follow when designing and running workloads in the cloud. Designing for the cloud is much different than designing for an on-premises architecture, and this framework helps you understand the pros and cons of decisions you make while building systems on AWS. By using the framework, you will learn architectural best practices for designing and operating reliable, secure, efficient, and cost-effective systems in the cloud. The well-architected approach to building systems will highly likely provide ...