AWS Certified Security Specialist Podcast

1.3.9 Capturing relevant forensics data from a compromised resource (for example, Amazon Elastic Block Store [Amazon EBS] volume snapshots, memory dump)

18 Sep 2025

Audio

Description

1.3.9 Capturing relevant forensics data from a compromised resource for example, Amazon Elastic Block Store Amazon EBS volume snapshots, memory dump - In this episode, we dive into the essential skill of capturing forensic data from compromised AWS resourcesa key competency for anyone pursuing the AWS Certified Security - Specialty SCS-C02 certification. We discuss how engineers preserve critical evidence, such as Amazon EBS snapshots and memory dumps, to support incident investigations, root cause analysis, and compliance with legal or regulatory requirements. Youll learn about best practices for gathering and securing forensic artifacts using AWS services like EC2, S3, KMS, and Systems Manager, while maintaining chain of custody and data integrity. We examine practical workflows, including using automation with Lambda and EventBridge, to streamline evidence collection during live incidents detected by tools like GuardDuty and Security Hub. Security experts will find tips on choosing the right forensic tools, handling volatile data without contamination, and securely storing collected evidence in isolated AWS accounts with encryption and strict access controls. Finally, we break down real-world scenarios, covering everything from initial log analysis to automated artifact preservation, empowering listeners to protect their cloud environments with confidence.

Transcription

This episode hasn't been transcribed yet

Help us prioritize this episode for transcription by upvoting it.

0 upvotes

🗳️ Sign in to Upvote

Popular episodes get transcribed faster

Other recent transcribed episodes

Transcribed and ready to explore now

3ª PARTE | 17 DIC 2025 | EL PARTIDAZO DE COPE

01 Jan 1970

El Partidazo de COPE

13:00H | 21 DIC 2025 | Fin de Semana

01 Jan 1970

Fin de Semana

12:00H | 21 DIC 2025 | Fin de Semana

01 Jan 1970

Fin de Semana

10:00H | 21 DIC 2025 | Fin de Semana

01 Jan 1970

Fin de Semana

13:00H | 20 DIC 2025 | Fin de Semana

01 Jan 1970

Fin de Semana

12:00H | 20 DIC 2025 | Fin de Semana

01 Jan 1970

Fin de Semana

Comments

There are no comments yet.

Please log in to write the first comment.

Report any issue

AWS Certified Security Specialist Podcast

1.3.9 Capturing relevant forensics data from a compromised resource (for example, Amazon Elastic Block Store [Amazon EBS] volume snapshots, memory dump)

This episode hasn't been transcribed yet

Other recent transcribed episodes

3ª PARTE | 17 DIC 2025 | EL PARTIDAZO DE COPE

13:00H | 21 DIC 2025 | Fin de Semana

12:00H | 21 DIC 2025 | Fin de Semana

10:00H | 21 DIC 2025 | Fin de Semana

13:00H | 20 DIC 2025 | Fin de Semana

12:00H | 20 DIC 2025 | Fin de Semana

Sign in to Audioscrape

Share this moment