Incident Response in Google Cloud

Course Description

This intensive course is designed to teach investigators techniques needed to respond to an investigation of a Google Cloud organization. The fast-paced course is built upon a series of hands-on labs that highlight how to investigate and respond to a targeted attack in a Google Cloud organization. Examples of skills taught include how to identify evidence of a threat actor using Google Cloud native tools, utilize open source utilities to enhance the investigators capabilities, and provide effective containment and eradication of a threat actor. 

The course includes detailed discussions of evidence collection and their limitations as well as how threat actors move around in the Google Cloud organization. This information is then re-enforced through a dynamic hands-on lab environment powered by Google Cloud Skills Boost. The labs will have recent evidence of compromise and provide each student with their own lab environment.

Learning Objectives

In this lab, you will learn how to perform the following tasks:

• Define the NIST Incident Response Process
• Utilize the MITRE ATT&CK during an investigation
• Identify the core components of a Google Cloud Organization
• Utilize Log Explorer and Log Analytics to perform cloud investigations
• Deploy and update a Compute Instance for local analysis
• Identify logs for:
  • Service Account abuse
  • Service Account Key creation
  • Storage Bucket access
  • GKE container logs
• Utilize open-source tools like Plaso, Timesketch, dfTimewolf, and many others