START-HERE AWS Incident Response Preparedness Service

If you are experiencing a cybersecurity incident now, call X-Force to help. (See phone numbers in Support Information section below).

Increase your preparedness with IBM’s START-HERE AWS Incident Response (IR) Preparedness Service. Forward-leaning organizations are embracing security advisory services to help guide their readiness to secure workloads, respond to threats and manage risk in cloud environments.

Security organizations must be ready to manage security in AWS Cloud. Security preparedness includes: • Effective delivery of customer shared responsibility for managing security and compliance • Optimized operation of AWS native security services and controls • Updated and tested incident response run plan

START HERE: IBM Security has worked with AWS to create a logical starting place to confirm and/or prepare for Incident Response (IR). This Incident Response Preparedness service includes the following: • Rapid AWS Security Assessment and mapped to AWS Level 1 capabilities • Activation and configuration of foundational AWS native security services for Threat Detection • X-Force Incident Response Retainer including extensive list of proactive IR services in addition to emergency incident support

AWS Level 1 Security Assessment: The service begins with an AWS Level 1 Security Assessment to analyze current security posture and provide recommendations to address gaps around vulnerability and risk related to your AWS Cloud workloads.

IBM’s Level 1 Assessment brings visibility into security misconfigurations, traffic analysis and compliance against security and data privacy frameworks (such as NIST, ISO, CCPA, HIPAA, and PCI) across your AWS environment. IBM consultants walk through the security findings in an interactive, structured session which provides key recommendations to closing those gaps in a security assessment report.

This Level 1 assessment provides a comprehensive analysis of: • Existing cloud architecture, account structure including subscriptions and resource tagging for security implementation • Review of monitoring and log management, data encryption, network and application security, endpoint security, identity and access management controls and security configuration. • Compliance checks for PCI DSS, HIPAA, CIS Benchmarks, NIST CSF/800-53, etc.

Activate and Deploy Secure AWS Foundation The IR Preparedness service deploys and configures foundational AWS infrastructure to support a secure, scalable, multi-account environment based on selected AWS native security services and AWS best practices. The Start-Here service includes configuration of base level AWS threat detection services for centralized logging and alerting. Native services include: AWS Security Hub, Amazon GuardDuty, Amazon Inspector and Amazon Detective.

Equipped with industry and compliance aligned templates, IBM brings automation and Infrastructure as Code tools to establish threat detection architecture using AWS native services and best practices framework.

X-Force Incident Response Retainer: The IR Preparedness service includes IBM’s X-Force Incident Response Retainer (XFIR Retainer). XFIR Retainer is an annual digital forensics incident response subscription service aligned to AWS and hybrid cloud. X-Force IR Retainer includes a menu of proactive services to choose from, 24x7x365 phone access to our elite team of X-Force consultants and 24-48 hour boots on the ground emergency incident support if needed. X-Force IR operates under a global delivery model which means that it can support your company’s business operations anywhere in the world for both incident response and proactive services.

Proactive services available with X-Force IR Retainer can include: Active Threat Assessment, Cyber Range Experiences, Cyber Crisis Management, Cyber Threat Intelligence Assessment, Review or Development of Cybersecurity Incident Response Plan, Dark Web Search Service, Incident Response Playbook Customization, Incident Response Program Assessment, Ransomware Readiness Assessments, Security Incident First Responder Training, Tabletop Exercises, Manual Penetration Testing and Strategic Threat Assessment.

X-Force IR Retainer includes access to an autonomous team of expert IR professionals. IR teams have deep experience in AWS Cloud, hybrid and multi-cloud environments including cloud native security services.

IBM Security is a leader in comprehensive AWS Level 1 MSSP services including Digital Forensics Incident Response Specialization. X-Force IR Retainer is among a broad set of IBM’s AWS Level 1 MSSP capabilities. Customers can choose to extend to other Level 1 capabilities including X-Force Threat Management Services (XFTM), IBM’s Managed Detection and Response service and other services. These services provide end-to-end threat management and recovery designed for AWS and extended to hybrid cloud environments.

Are you prepared for a data breach or cybersecurity incident?