All tabletop exercises
Cloud·Starter·Technical audience
A production cloud access key is pushed to a public repository
The prompt — read this to the room
It is 10:40 on a Tuesday. A secret-scanning service emails your security inbox: a long-lived access key for your production deployment account was pushed to a public code repository 47 minutes ago, from a contractor's personal fork. The key has administrator rights. Your cloud audit log shows calls made with that key in the last ten minutes from an address nobody recognises, and the release pipeline uses the same key for tonight's deploy. The contractor is not answering their phone. What do you do in the next fifteen minutes?
Total duration
1 h 15 min
People to involve
5
Best fit
Saas
Who to involve
Most important first.
- Cloud engineer
- Incident response lead
- Developer / DevOps
- SOC analyst
- CISO / Head of security
What it tests
- Deactivate a leaked credential within minutes while knowing what will break when you do.
- Use cloud audit logs to list every action the key took between exposure and revocation.
- Find and remove persistence an attacker created with the key, not just the key itself.
- Agree the controls that would stop a long-lived administrator key from existing at all.
Outline of activities
- 1The alert: confirm the exposure is real and the key is live
- 2Containment: revoke the key and accept or work around what breaks
- 3Scoping: read the audit trail for what the key and its children did
- 4Clean-up: persistence, repository history, forks and the contractor
- 5Prevention: short-lived credentials, pre-commit scanning and contractor access
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…