All tabletop exercises
Cloud·Starter·Mixed audience
A cloud bill jumps by $180,000 overnight
The prompt — read this to the room
The finance team forwards a billing alert at 08:15: your cloud spend for the last 24 hours is $182,400 against a usual $3,000. The cloud team finds hundreds of large GPU instances running in four regions you have never used. They were launched from the root account of a development tenancy that nobody has logged into for a year. Its recovery email points to a former employee's personal address. Your provider's support line says a credit "may be considered" once you secure the account. The instances are still running and costing roughly $7,500 an hour.
Total duration
1 h 30 min
People to involve
5
Best fit
Saas, Education
Who to involve
Most important first.
- Cloud engineer
- CISO / Head of security
- CFO / Finance
- CIO / CTO
- Incident response lead
What it tests
- Stop the spend quickly while preserving enough evidence to support a provider credit request.
- Regain control of an orphaned root account and secure the recovery path.
- Check whether the attacker reached any other accounts, data or billing settings.
- Agree who owns dormant cloud accounts and what spending alerts trigger action.
Outline of activities
- 1The bill: confirm it is an attack, not a runaway job
- 2Stop the bleeding: shut down, quarantine and lock out
- 3Regain the root account and close the recovery path
- 4Scope: other accounts, data, and what else the attacker set up
- 5The money: provider credit, insurance and internal accountability
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…