Lion Cipher Lab

Stop, terminate or isolate a compromised EC2 instance? Measure what evidence survives each choice

• Cloud Security
• Intermediate
• ~60 min
• Free · no account required

Why it matters

The finding says one of your servers is talking to a known attacker address. The first instinct is to switch it off or delete it, and both instincts can destroy the only proof of what the attacker took, while leaving the attacker's stolen keys working from their own laptop. The opposite instinct, 'just swap the security group', often leaves the attacker's open connection running, because AWS does not cut connections it is already tracking. This lab turns those trade-offs into numbers: you build a small simulator that applies documented AWS behaviour to four realistic instance states, run…

What you'll learn

• reading an EC2 instance's state the way a responder does: DeleteOnTermination on every EBS volume, instance store, RAM, the instance profile, the security groups, the egress path
• knowing exactly what stop, terminate, a security group swap, a NACL deny, detaching the instance profile and revoking role sessions each destroy and each leave behind
• applying the documented security group connection tracking rule to predict whether an attacker's existing connection survives an isolation group
• spotting the two Auto Scaling traps: a stopped or isolated instance gets replaced, and the replacement deletes a DeleteOnTermination root volume
• ordering containment steps so memory capture, snapshots and credential revocation do not undo each other
• measuring several plans against a per-scenario rubric and defending one in writing

Steps in this lab

1. The words first: the finding, the server, and everything it is made of
2. The decision you are about to measure
3. Open a terminal, check Python, and make a folder
4. Generate the four instance states
5. Predict before you compute: read db-theft by hand
6. The rules the simulator encodes, each from an AWS document
7. Build the simulator: ir_sim.py
8. Run it: miner-web, where both instincts destroy the root disk
9. db-theft: the NAT gateway trap, step by step
10. creds-stolen: the instance is not the problem
11. regulated: a data disk that was set to die, and a capture path you can cut yourself
12. The scoreboard, and why order matters as much as choice
13. Flip one fact and watch the reason change
14. Write your decision for miner-web: two defensible paths
15. What you would run in a real account (shown, not run here)
16. What the simulator does not model (the honest negatives)
17. Judgment: when to stop, when to terminate, when to isolate, and how a pro does it

Open the full interactive lab →