"ECS Forensics & Incident Response" will focus on the importance of implementing an effective incident response plan and the role of ECS (Elastic Container Service) in conducting forensic investigations. The presentation will begin by discussing the current threat landscape and the need for organizations to prepare for security incidents proactively. The speaker will then outline the various phases of incident response, including preparation, identification, containment, eradication, and recovery. The talk will also cover how ECS can be leveraged to perform forensics investigations during the identification phase, with a focus on the various tools and techniques that can be used to gather data and analyze events. The speaker will discuss the challenges associated with conducting forensic investigations in a containerized environment and provide best practices for overcoming these challenges. Finally, the presentation will highlight the importance of collaboration between security teams and other stakeholders within the organization, emphasizing the need for communication and coordination during an incident. Attendees will leave with a deeper understanding of how ECS can play a critical role in incident response and forensics investigations, and with practical tips for improving their organization's security posture.

1. ECS Forensics &
Incident Response
Cado Security | 1

2. What is ECS?
https://www.cadosecurity.com/aws-ecs-fully-managed-but-frustrating-to-investigate/

3. How does GuardDuty work with
ECS?
https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html

4. CloudTrail Logs
● Shows: API Level Calls
● Usefulness: Low
● Collected by: S3
Amazon S3
Container Investigation Data Sources in AWS
EKS Audit / Control Plane Logs
● Shows: API Level Calls
● Usefulness: Medium
● Collected by: S3
Amazon EC2 - Hosting EKS/ECS Inside Container - EKS/ECS on Fargate/EC2
Docker Logs
● Logs what containers were started, stopped
● Usefulness: Medium
● Collected by: EC2 Import or Cado Host
Docker Container Filesystems
● Normally overlay2 versioned filesystem
● Contains all the files from all the containers
● Usefulness: High
● Collected by: EC2 EBS (API) or Cado Host (SSM/SSH)
Container Filesystems
● Live filesystem as seen by the container, Memory
● Contains all the files from all the containers
● Usefulness: Very High
● Collected by: Cado Host (ECS Exec/kubectl exec))

5. How do you Investigate an ECS
Container in Cado?
https://docs.cadosecurity.com/cado-response/discovery-import/import/aws/aws-ecs

6. How do you Remediate a
compromised ECS Cluster?
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_remediate.html#compromised-ecs

7. Cado Response
Free 14-day trial
Receive unlimited access to
the Cado Response Platform
for 14 days.
www.cadosecurity.com/free-investigation/