Blog Post: the anatomy of a ransomware event targeting data residing in Amazon S3
I've been focused on ransom in the cloud for the past several years in my role at AWS. During Covid there was a spike in the amount to ransomware attacks in the news and customers starting asking about the cloud. I immediately partnered up with our AWS CIRT Team, to find out what the actual partners are and went on a campaign to document, speak and educate customers on what's actually happening... Here's a blog post I co-authored, in Feb 2023, on the AWS Security Blog, The anatomy of ransomware event targeting data residing in Amazon S3. Key takeaways:
- This type of attack is 100% preventable!
- Most cloud based security events come down to accidental leaked static access keys. It may seems really tough but its time to eliminate all long-lived credentials. Most cloud based security incidents come from leaked access keys so focus on re-architecting to eliminate. Use federation for developers, using IAM roles for resource to resource access. This is one of those items where 20% of the effort makes 80% of the value... Eliminating static access keys will drive down your risk of experiencing a security event, the effort is worth the value!
- PSA: If you experience a security event in AWS, contact technical support and ask for help - they will connect you to the AWS CIRT team who will help as much as they can and keep the incident completely confidential.
- Backup your resources.
- Make it hard to delete critical resources.
