Egress Monitor Alert: Next Steps

What should I do when I receive an Egress Monitor email?

A notification from Wasabi’s Egress Monitor can indicate unexpected data transfers from your storage, which may point to security vulnerabilities or malicious activity. Although Wasabi offers free egress, such notifications should be treated as a potentially critical alert, as unusual egress patterns can signal potential ransomware attacks or unauthorized data access. Investigating and addressing these anomalies promptly can help protect your data.

What steps should I take if I suspect there is unauthorized activity?

Start by reviewing your access logs for unusual or unauthorized activity. Use tools such as Wasabi’s administrative activity logs or bucket logging features, or external monitoring solutions to identify irregularities. Examples of irregularities are data transfers from unfamiliar IPs, unexpected users, or activity during off-hours. Review access keys and users provisioned on your account. If anomalies are detected, it could indicate compromised credentials or internal misconfigurations that need immediate remediation.

How can I make my account more secure?

Strengthen your defenses by implementing robust security measures. Rotate access keys, enforce Multi-Factor Authentication (MFA) for all users, enable Wasabi’s Multi-User Authentication (MUA) to prevent malicious bucket and account deletion, and review your bucket permissions to ensure they follow the principle of least privilege. 

For ransomware prevention, ensure you have immutable backups using Object Lock. Have copies of your data replicated within different accounts with stricter security measure to ensure redundancy.

Finally, set up a proactive monitoring and alerting strategy. Conduct regular audits of your storage and access policies to minimize vulnerabilities. By staying vigilant and leveraging Wasabi’s many security features, you can ensure your data remains safe even with evolving threats.

What happens if I receive an Egress Monitor email but everything looks normal?

In the event that everything looks normal and you have taken the steps above to mitigate any possible threat, you may not need to take any action. Wasabi sends these emails as a way to keep you informed and to keep your data as safe as possible.