From the course: AWS Certified Security - Specialty (SCS-C02) Cert Prep

Preserving forensic artifacts with S3 Object Lock - Amazon Web Services (AWS) Tutorial

From the course: AWS Certified Security - Specialty (SCS-C02) Cert Prep

Start my 1-month free trial Buy for my team

Preserving forensic artifacts with S3 Object Lock

“

- [Instructor] Let's take a look here at capturing forensic artifacts, and if you've detected and analyzed a security incident, the thing that you're going to do next is look at the logs, snapshots, and other evidence, and it's important to preserve these artifacts. So what Amazon S3 Object Lock does is it blocks object deletion and provides an additional layer of protection against either accidental or intentional data alteration. There's a couple different modes as well. So we first have governance mode, which allows a privileged user to alter the lock settings. We also have compliance mode, where not even the root user itself can actually change that lock. And if you look at storing artifacts in S3 with object lock, you can move these forensic artifacts into a dedicated S3 bucket, and these would be stored securely with encryption and also access controls, and you could have retention policies that would be applied to the objects to preserve them for a specific period of time. And these policies could be customized to match the specific needs of whatever artifact you're storing. Now, this plays into the investigation process because with an ongoing investigation, you would be able to guarantee that the data hasn't been altered in a subtle way, especially if the attack is an insider attack, for example. So in terms of compliance considerations, the use of S3 object lock is really essential in meeting specific regulatory requirements, especially in the fields of financial or healthcare data. Also here, it's important to notice the WORM pattern, which is write once, but read many. So in this particular pattern here as you store this forensic data, it's been able to be written, but never again is it able to be mutated because you need to preserve that original forensic data.

Contents