Cloud Security Operations · Topic 6 of 6
Security Operations, Incident Response and Communication
CCSP security operations: SOC, intelligent monitoring, SIEM and threat intel, incident response, vulnerability tests and talking to vendors and regulators.
- 4 min
- The SOC needs cloud specific feeds: management plane, identity, flow, workload and SaaS logs.
- Monitor the controls themselves; disabled logging is an attack signal.
- IR phases: preparation, detection and analysis, containment, eradication, recovery, post-incident.
What it is
Security operations watch the environment continuously, detect threats, respond to incidents and test defences. The security operations center (SOC) is where this happens, using monitoring of security controls, log analysis in a SIEM and threat intelligence.
Communication is part of the same work. Incidents and changes affect vendors, customers, partners, regulators and others, and each needs the right message at the right time.
How it works
The SOC
A SOC monitors, detects, triages, investigates and responds. It may be in house, outsourced to a managed security service provider, or a hybrid. In the cloud it needs feeds from management plane logs, identity logs, network flow logs, workload and application logs, and SaaS audit logs.
Intelligent monitoring of security controls
| Control | What to monitor |
|---|---|
| Firewalls and network security groups | Rule changes, denied traffic patterns, unexpected open ports |
| IDS and IPS | Alerts, blocked attacks, sensor health |
| Honeypots | Any interaction, which is suspicious by definition |
| AI driven analytics | Behaviour baselines for users and workloads, anomaly alerts |
Monitoring the controls themselves matters: a disabled log source or a changed rule is often an attacker's first step.
Log capture and analysis
- Log management: collect, normalize, store and retain logs centrally with integrity protection.
- SIEM: correlates events across sources, applies detection rules and raises alerts.
- Threat intelligence: feeds of indicators and attacker techniques that enrich alerts and drive threat hunting.
Incident response
| Phase | Cloud specific actions |
|---|---|
| Preparation | Plans, run books per service category, provider contacts, pre-built forensic tooling |
| Detection and analysis | Validate the alert, scope affected accounts and services |
| Containment | Revoke keys, disable accounts, isolate instances with security groups |
| Eradication | Remove persistence such as new users, roles and keys created by the attacker |
| Recovery | Rebuild from known good images, restore data, monitor closely |
| Post-incident | Lessons learned, update controls and plans |
The provider handles incidents in its layers; the contract should define how and how quickly it notifies customers.
Vulnerability assessments and penetration testing
| Activity | Purpose |
|---|---|
| Vulnerability assessment | Automated, regular scans for known weaknesses and misconfigurations |
| Penetration testing | Authorized, goal oriented attempts to exploit weaknesses, showing real impact |
Before testing in the cloud, check the provider's testing policy. Many allow testing of the customer's own resources without asking, but forbid denial of service tests and any testing of the provider's own infrastructure or other tenants.
Managing communication with relevant parties
| Party | Typical communication |
|---|---|
| Vendors | Incident coordination, vulnerability reports, change notices, contract and SLA reviews |
| Customers | Service status, planned maintenance, incident and breach notifications, shared responsibility guidance |
| Partners | Shared incident handling, changes to interfaces, joint security requirements |
| Regulators | Mandatory breach notifications within legal deadlines, audit evidence, responses to inquiries |
| Other stakeholders | Senior management, legal counsel, insurers, law enforcement and the media through approved spokespeople |
Good communication is planned: contacts and escalation paths are defined in advance, messages are approved by legal and management, channels are secure and out of band if the main systems are compromised, and timing meets contractual and legal duties. GDPR, for example, requires notifying the supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals.
A worked example
The SOC sees a spike in data downloads from a SaaS file service by one account at 03:00, from an unusual country. The SIEM correlates this with a successful login that bypassed MFA through a legacy protocol.
The responder disables the account, revokes its sessions and blocks the legacy protocol. Legal counsel is engaged, the SaaS provider is asked for detailed logs, and affected customers and the regulator are notified within legal deadlines through prepared templates. The lessons learned review adds a detection rule for legacy protocol logins.
How the exam asks about this
- "Before running a penetration test against IaaS workloads, what should the customer do FIRST?" Review the provider's testing policy and obtain written authorization.
- "Which tool correlates events from many log sources to detect attacks?" A SIEM.
- "Who should approve external communications about a breach?" Senior management with legal counsel, through designated spokespeople.
What to remember for the exam
- The SOC needs cloud specific feeds: management plane, identity, flow, workload and SaaS logs.
- Monitor the controls themselves; disabled logging is an attack signal.
- IR phases: preparation, detection and analysis, containment, eradication, recovery, post-incident.
- Check the provider's testing policy before any penetration test.
- Plan communication with vendors, customers, partners, regulators and other stakeholders in advance.
Never test the provider's infrastructure or other tenants. Even with the best intentions, unauthorized testing can breach the contract and the law.
Common mistakes
Shutting down evidence during containment. Contain by isolating and revoking access, not by deleting resources.
Improvising breach communication. Without prepared contacts and approvals, deadlines are missed and messages conflict.
Confusing vulnerability assessment with penetration testing. Scans list weaknesses; penetration tests exploit them to show impact.
Check yourself
What is the role of threat intelligence in the SOC?
It provides indicators and information on attacker techniques that enrich alerts, improve detection rules and guide threat hunting.
What is eradication in incident response?
Removing the attacker's foothold, such as malicious accounts, keys, roles and malware, before recovery.
Why should incident communication channels be out of band?
Because the main email or chat systems may be compromised or unavailable during the incident.
Topic 6 of 6 in Cloud Security Operations
Test yourself on Cloud Security Operations
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.