An organization discovers that an exposed API key associated with a cloud storage container was leaked on a public repository, allowing unauthorized external downloading of sensitive customer backups. Place the following incident response workflow steps in the correct chronological order according to standard incident handling frameworks.
- 1Analyze cloud audit logs and storage access metrics to determine the scope of unauthorized access and identify compromised assets.
- 2Revoke the exposed API key, issue new credentials, and temporarily restrict public access to the affected cloud storage bucket.
- 3Rotate all associated service accounts, purge unauthorized persistence mechanisms, and verify security configurations of the cloud environment.
- 4Restore normal bucket operations, enable enhanced logging, and monitor access requests for anomalous behavior.
- 5Conduct an after-action review meeting to document timeline events, identify root causes, and update secrets management playbooks.
Answer
The correct chronological order of the incident response workflow is: (1) Analyze cloud audit logs to confirm scope, (2) Revoke the exposed API key and restrict storage access, (3) Rotate service accounts and purge unauthorized persistence, (4) Restore normal bucket operations and monitor access, and (5) Conduct an after-action review to update playbooks.
According to NIST SP 800-61 incident response guidelines, response follows a defined sequence: Detection & Analysis (analyzing cloud logs to determine scope), Containment (revoking the leaked key and restricting bucket permissions), Eradication (rotating service accounts and remediating access vulnerabilities), Recovery (restoring production access with monitoring), and Post-Incident Activity (conducting an after-action review).
Step-by-Step Solution
Key Concept
NIST Incident Response Lifecycle Phases (Detection/Analysis -> Containment -> Eradication -> Recovery -> Post-Incident Activity)