CCSI Officer course · Module 09 of 10
Operations, vulnerability response and audit
Running confidential workloads day to day: monitoring attestation, responding to hardware and firmware advisories with TCB recovery, investigating incidents with audit logs, and preparing evidence for auditors.
Learning objectives
- Monitor attestation outcomes and alert on anomalies
- Respond to a TEE vulnerability advisory, including TCB recovery
- Use cloud audit logs to investigate key release events
- Assemble an evidence pack for an internal or external audit
Lessons
Lesson 9.1 · 11 min
Monitoring attestation in production
Signals to collect, what normal looks like, and which events should page someone.
Lesson 9.2 · 14 min
Advisories and TCB recovery
What to do when a CPU, firmware or GPU vulnerability affects your TEE.
Lesson 9.3 · 13 min
Incident investigation and audit evidence
Questions to answer in an incident, and the evidence pack auditors expect.
Check your understanding
Module 9 quiz
6 questions · pass mark 80%
1.Why should attestation decisions be logged outside the TEE?
2.What does TCB recovery involve?
3.What is the risk of raising the minimum TCB before the provider has rolled out the fix?
4.Which AWS service records AWS KMS API calls for investigation?
5.During an incident, why check for non-attested paths to a key?
6.Which statement belongs in a good evidence pack?
Glossary
- TCB version
- Security version numbers of firmware and microcode reported in attestation evidence.
- TCB recovery
- Patching a TEE vulnerability and then requiring the fixed TCB version in verification policy.
- Fail closed
- When a check cannot pass, deny access rather than allow it.
- Evidence pack
- The collection of documents and logs that demonstrates controls to an auditor.