Topic 13 · Deep Dive

13.5 Basic Cloud Incident Reporting and Support Steps

Detect: Trust the Anomaly, Not Your Memory

Most personal cloud incidents surface as three signals: a sign-in alert for a device or city you do not recognize, mail or files you did not send or share, and a sudden spike of storage or version activity. Confirm fast and cheaply -- open the session map and audit feed from a known-clean device, and do not dismiss "maybe it was my phone." Log the UTC timestamps of the first and latest suspicious event; you will need that window for everything downstream, and provider log retention is short.

Contain: Lock the Account Before You Investigate

Containment order matters. Sign out everywhere, which revokes session and refresh-token grants at the identity provider; change the password, which invalidates remaining sessions server-side; revoke connected-app tokens; then rotate your second factor if the attacker could see it. Pause sync clients on machines you suspect are infected, otherwise a keyed-out device immediately re-authenticates and re-seeds the compromise. Check the one thing attackers change first: recovery email and phone. If your recovery contacts are wrong, you are racing whoever changed them -- tell the provider immediately.

Report Through Channels You Can Prove

Use the in-product security flow or verified support number, never a support link found in an email that arrived during the incident. State the facts in machine-checkable form: affected account, event window in UTC, which controls you already changed, and a request to preserve logs and enable lockdown on the mailbox while you recover. Ask for a case reference and enable every alert. If mail or files were exfiltrated, notify the people whose data was exposed -- their inboxes are now your second incident.

Recover: Restore, Then Hunt the Persistence

Use version history or snapshots to roll files back, but before declaring victory, look for persistence the attacker left behind: mail rules forwarding to a stranger, filters deleting your alert mail, new share links, re-added devices, and re-granted OAuth apps. Restore without hunting persistence just replays the incident a week later.

Architecture Diagram

incident lane detect anomaly audit alert lock account notify provider snapshot restore attacker already changed recovery email
Containment must precede everything: a locked account with attacker-controlled recovery contacts is still the attacker's account.

Key Takeaways

« Back to Topic 13« 13.4