Lesson 9.3 · 13 min read
Incident investigation and audit evidence
Questions to answer in an incident, and the evidence pack auditors expect.
Investigating a suspected key misuse
- Which identities called decrypt or key release on the key, from where, and when? (CloudTrail, Cloud Audit Logs, Azure Monitor)
- Were those calls attested? Which measurements and TCB levels were presented?
- Was any policy changed shortly before? By whom, and was it approved?
- Are any non-attested paths to the key (another Allow statement, a grant, a backup) available?
The evidence pack
| Evidence | Demonstrates |
|---|---|
| Threat model and trust boundary diagram (Module 1) | What the system protects, and from whom |
| Key policies and release policies, with change history | That keys require attestation |
| Reference-value approval records (Module 8) | Which code is allowed and who approved it |
| Sample attestation logs and alerts | That the controls operate in practice |
| Advisory response records (this module) | That vulnerabilities are handled |
| Access reviews for policy administrators | Separation of duties (Module 6) |
Key takeaways
- Use audit logs to reconstruct who obtained keys, with what evidence, and under which policy version.
- Check for non-attested paths to keys during any incident.
- Build the evidence pack continuously, not just before the audit.
End of module 9
Take the module 9 quiz to check your understanding.