Monitoring, Detection & Incident Response
30 items · source
Monitoring / Detection
- Monitor authentication anomalies.
- Monitor repeated authorization failures.
- Monitor privilege changes.
- Monitor API-key creation.
- Monitor API-key rotation.
- Monitor MFA changes.
- Monitor password-reset spikes.
- Monitor signup spikes.
- Monitor unusual exports.
- Monitor large downloads.
- Monitor storage enumeration.
- Monitor webhook abuse.
- Monitor IAM changes.
- Monitor GitHub workflow changes.
- Monitor production branch changes.
- Monitor unexpected origin requests.
- Monitor secrets-access anomalies.
- Alert on direct-origin traffic where it should not occur.
Incident Response
- Document how to rotate JWT signing secrets.
- Document how to rotate database credentials.
- Document how to rotate GitHub credentials.
- Document how to rotate Google service credentials.
- Document how to revoke Apple signing credentials.
- Document how to revoke active sessions.
- Document how to disable compromised accounts.
- Document emergency DNS rollback.
- Document emergency deployment freeze.
- Document compromised-container response.
- Document stolen mobile credential response.
- Test the incident-response procedures.
# Monitoring, Detection & Incident Response ## Monitoring / Detection * [ ] Monitor authentication anomalies. * [ ] Monitor repeated authorization failures. * [ ] Monitor privilege changes. * [ ] Monitor API-key creation. * [ ] Monitor API-key rotation. * [ ] Monitor MFA changes. * [ ] Monitor password-reset spikes. * [ ] Monitor signup spikes. * [ ] Monitor unusual exports. * [ ] Monitor large downloads. * [ ] Monitor storage enumeration. * [ ] Monitor webhook abuse. * [ ] Monitor IAM changes. * [ ] Monitor GitHub workflow changes. * [ ] Monitor production branch changes. * [ ] Monitor unexpected origin requests. * [ ] Monitor secrets-access anomalies. * [ ] Alert on direct-origin traffic where it should not occur. ## Incident Response * [ ] Document how to rotate JWT signing secrets. * [ ] Document how to rotate database credentials. * [ ] Document how to rotate GitHub credentials. * [ ] Document how to rotate Google service credentials. * [ ] Document how to revoke Apple signing credentials. * [ ] Document how to revoke active sessions. * [ ] Document how to disable compromised accounts. * [ ] Document emergency DNS rollback. * [ ] Document emergency deployment freeze. * [ ] Document compromised-container response. * [ ] Document stolen mobile credential response. * [ ] Test the incident-response procedures. 30 items · https://github.com/FarzamHabibi/pre-production-checklist · CC BY 4.0