A lot of people are intimidated by cloud security...that fear of the unknown. I used to be (and not long ago..) but it's actually not that complicated. Here's a few things to do to get started with #aws security from a blue team perspective 👇
Understand the basics. Learn the foundational services (EC2, VPC, RDS, EKS, Lambda)…AWS has tons of free training and documentation.
Learn IAM. Protip: it’s not Active Directory so there’s a learning curve but once you start to understand this, then it all will start to click (security-wise).
Understand the Shared Responsibility model - You’re now responsible for protecting the control plane (API) AND all of the actual computers (VMs/containers/etc.) - This is how you understand to architect sound security solutions (to include detection and response)
Learn GuardDuty and it’s detection use-cases (findings). Some of these are really noisy and some are really good.
CloudTrail is your bread and butter as a blue team. Learn these logs and their schema because when an incident happens, you’ll probably be swimming in these.
