People & Security

Education Level: Basic

6115 - Encore Presentation - Incident Response in the Azure Cloud

Speaker(s)

• DW

  Daniel Watson, Jr., CISSP, Security+

  Global Sr. Managing Consultant Cybersecurity
  IBM

This presentation outlines the presenter's experiences responding to a incident declared by a customer who had established a new instance of Azure and did not secure the environment correctly with respect to external connectivity. During the presentation we will talk to the challenges of IR in the cloud versus our traditional on-premise activities. We also will review basic Azure instrumentation including Azure powershell and Security Center. This will not be a review of how to conduct IR for the cloud; it will outline the differences seen and what those impacts can be. Finally, we'll summarize the key points learned from engaging and preparing post-mortem data collection as it relates to the Azure cloud.

Learning Objectives:

• Identify the accommodations for the Azure cloud in a IR session.
• Identify native Azure resources available to the IR team available in the Azure cloud.
• How to prepare for the future data collection and automate those activities.