Once you have identified a compromised instance, you must isolate it from everything else and remove it from your production network, thus preventing anything else from gaining access to it. There are a number of different steps you could take to do this:
- You should build in a forensic security group within your production environments. This allows you to quickly change the EC2 instance security group to one that prevents it from communicating with any other resource on your network. This effectively removes it from the network as no other connection can be made to or from it. If and when you need to connect to the resource, configure the security group using very specific ports and protocols (such as SSH and RDP) and configure the inbound source as a single IP address of the engineer that will be connecting.
- Create a snapshot of the EC2 instance, allowing you to restore it somewhere else in a secure environment for further analysis.
- If possible, take a memory dump of the instance...
