What a Cloud Bill Can Reveal
summary
Shows how cloud billing becomes a forensic signal: use AWS Cost Explorer (daily granularity, group by service/region/tag) to spot a new g3.4xlarge EC2 spike consistent with crypto‑mining, identify 475 GB of S3 egress from bucket PROD1 by filtering on S3 Data Transfer - Internet (Out) and GetObject API calls, and infer Azure Communication usage (one inbound SMS) from billing lines. Recommends 30 GB usage budgets with an 80% alert and Cost Anomaly ML at 10% deviation.
AI-written summary · about
chapters (11)
- 0:00Cloud billing in cybersecurity
- 4:22Cloud billing models
- 9:49Cost analysis tools AWS Azure GCP
- 13:47Threats via billing anomalies
- 21:32Forensic insights from billing
- 27:43S3 exfiltration case study
- 28:48Azure misuse detection
- 29:50Cost and usage alerts
- 34:14Billing analysis limits
- 36:48Implementation steps
- 38:58Q&A
related talks
42mPOST No AWS Bills: Cloud Cost Optimization without APIs
27mAnatomy of an AWS Account Cryptojack
30mAnd the CFO Wept: AWS Cost Control
20mHow Do I Reduce My Cloud Bill?
12mHow Unit Costs will change the way you think about your cloud bill
31mThe AWS Billing Machine and Optimizing Cloud Costs
40mMulti-Cloud Anomaly Detection: Finding Threats Among Us in the Big 3 Clouds
45mCloud Computing: Cloud in a cost-effective way