AWS establishes Customer Incident Response Team

Amazon Web Services (AWS) has established a specialized, 24/7 global team known as the AWS Customer Incident Response Team (CIRT). This team is dedicated to supporting customers during active security events that occur on the customer side of the AWS Shared Responsibility Model.

The CIRT is comprised of security engineers who respond to cloud security events and develop the necessary tools and resources for incident management. Their focus is on assisting customers facing issues such as unauthorized access, data exfiltration, or ransomware attacks within their AWS environments.

Customers experiencing an active security event in their AWS environment should open an AWS support case through the AWS Support Center Console. It is crucial to indicate that the case involves an "urgent security incident" in the description. This process helps confirm account ownership and provides a case number for tracking engagements. Customers can also alert their assigned AWS account team, such as a Technical Account Manager (TAM) or Solutions Architect, to escalate the situation.

The AWS CIRT aims to provide expert assistance and resources to help customers mitigate the impact of security incidents and restore normal operations in their cloud environments efficiently.