Secure Legends GameDay - A Cloud Security Danger Room

This session is a hands-on AWS "game day," a simulated incident set at a fictional startup, Unicorn.Rentals. Attendees with laptops could join a live environment in their own AWS account. The scenario is a set of EC2 instances behind a load balancer whose content has been encrypted, with a ransom message left on the site. The speaker presents the exercise as a low-pressure way to build response experience that is hard to get during a real outage.

The group works through detection and analysis first, then containment, eradication and recovery. Load balancer metrics and networking options are considered, but the instance logs prove most useful. They reveal requests to a "backdoor" route that appears to run arbitrary shell commands on the server. The team isolates an affected instance by swapping its security group for one with no inbound rules, then blocks the route at the application load balancer with a fixed response. The vulnerable code stays in place for later review. The autoscaling group, driven by its launch template, replaces the encrypted instances, which are stopped rather than terminated so evidence is preserved.

The main takeaways are to follow the runbook in order, since the team skipped isolation at first, and to contain before eradicating. Deleting resources during an active attack destroys evidence that forensics will need. Blocking an endpoint at the edge buys time but does not remove the underlying backdoor. Involving the team that owns a resource before changing it is also part of the lesson.