In this lesson,
we're going to talk about decommissioning
or spinning down infrastructure after a pentest.
Now, when we say "spinning down infrastructure,"
we mean taking down our cloud-based testing systems offline
and removing any systems or servers
that we may have created.
This is an important step to ensure
that no unnecessary resources are left running,
which could pose security risks
or incur additional costs.
First, let's look at why spinning down infrastructure
is important.
During a pentest,
you might set up various virtual machines,
storage resources,
and networking components in the cloud
to simulate attack and test defenses.
Once the test is complete,
these resources should be decommissioned
to prevent any unauthorized access
or to prevent unnecessary expenses.
Now, I personally found myself
setting up a lot of different AWS systems in the past,
like databases and virtual private clouds,
during a pentest and lost track of them.
But Amazon doesn't lose track of these resources,
and I received an outrageous bill
for these resources that I have forgotten about.
Depending on how long the engagement is,
forgotten resources could end up being a substantial cost
if they aren't decommissioned.
The first step in spinning down infrastructure
is to identify all resources you created.
It's important to keep a detailed list
of things like virtual machines, containers, databases,
and other cloud services that you use during a test.
If you use AWS, you can review the AWS Management Console
to list the instances and services
running under your account.
AWS is pretty good about breaking down the cost
and letting you know what is running.
You just need to ensure
to check every region that you might have used,
since the dashboards are usually separated by region,
which isn't always obvious.
Next, you need to terminate these resources.
For virtual machines,
you stop and then terminate the instances.
In AWS, this can be done by selecting an instance
and choosing the "Terminate" option.
Similarly, for databases, you delete the database instances,
ensuring that the data backups are securely stored
or deleted as required.
In addition to terminating any active resources,
you should also check for any remaining stores
that might not be automatically deleted.
This includes volumes attached to virtual machines,
like AWS Elastic Beanstalk volumes,
and object storage, like AWS S3 buckets.
Ensure these storage resources are deleted
to prevent any residual data from being accessed.
Another important aspect is cleaning up
any network configuration set up during a test.
This can include virtual private clouds,
security groups,
and routing tables.
For example, you might have created a security group
to allow specific traffic for your testing purposes.
Once the test is complete,
you should delete any security groups
to close any open network paths that are no longer needed.
Finally, ensure that any logs
and monitoring data collected during the test
are securely stored and reviewed.
If these logs are no longer needed, securely delete them
to maintain good data hygiene and privacy.
So remember, spinning down infrastructure
is a key part of post-engagement cleanup.
By carefully identifying
and terminating all cloud resources,
deleting storage, and cleaning up network configurations,
you can ensure your cloud environment remains secure
and cost-effective after the penetration test.
This thorough cleanup process
helps to maintain the integrity and security
of your cloud infrastructure.