Automatically Detect and Mitigate Account Compromise Issues

In this course, you will learn how to deploy a method of detecting and mitigating account compromise issues. The solution uses services such as the AWS Personal Health Dashboard, AWS Lamba, and Amazon Simple Notification Service (Amazon SNS). The solution can be deployed to any customer, and the course includes sample solution files.

      •    Course level: Fundamental

      •    Duration: 30 minutes

Activities

This digital course includes presentations, demonstrations, and videos.

Course objectives

After completing this course, you should be able to:

      •    Define AWS Health service

      •    Recognize how AWS identifies compromise risk

      •    Identify and filter events using Amazon CloudWatch Events rules

      •    Prepare management and member accounts

      •    Deploy a suggested account compromise mitigation solution

Intended audience

This course is intended for:

      •    Cloud professionals

      •    Security investigators

      •    Software developers

      •    DevOps administrators

      •    IT administrators

      •    Network administrators

Prerequisites

We recommend that attendees of this course have:

      •    AWS Certified Cloud Practitioner

      •    AWS Certified Security – Specialty

Course outline

      •    Overview of existing risk scenarios

      •    Overview of AWS Health

      •    Walkthrough of solution phases – detection, notification, mitigation

      •    Introduction to CloudWatch Events pattern

      •    Introduction to Lambda automatic mitigation

      •    Setting up management accounts

      •    Setting up member accounts

      •    AWS architecture overview of solution

      •    Video walkthrough

      •    Deploying the solution

      •    Additional tips and takeaways

      •    CloudWatch Event Bus permissions