Penetration testing the cloud

What is Cloud Penetration Testing?

Cloud Penetration Testing is the process of detecting and exploiting security vulnerabilities in
your cloud infrastructure by simulating a controlled cyber-attack. Cloud pentest is performed
under strict guidelines from the cloud service providers like AWS, and GCP.

Cloud penetration testing helps to:

 Identify risks, vulnerabilities, and gaps

 Impact of exploitable vulnerabilities
 Determine how to leverage any access obtained via exploitation
 Deliver clear and actionable remediation information
 Provide best practices in maintaining visibility

Types & Methods of Cloud Penetration Testing

Cloud penetration testing will examine attack, breach, operability, and recovery issues within a
cloud environment. Different types of cloud penetration testing include:

 Black Box Penetration Testing—Attack simulation in which the cloud penetration

testers have no prior knowledge of or access to your cloud systems.
 Grey Box Penetration Testing—Cloud penetration testers have some limited knowledge
of users and systems and may be granted some limited administration privileges.
 White Box Penetration Testing—Cloud penetration testers are grated admin or root
level access to cloud systems.

Internal assessments
Cloud-based security assessment services are able to assess any system that is
accessible via the Internet, but internal assessments by cloud-based security assessment
services often are implemented through the use of managed appliances or software
agents that are deployed within the enterprise.

Customers of a cloud-based security assessment service should consider the following

when selecting a service provider with regard to understanding Internet vs. internal
assessments:
 Service providers that use appliances should be able to validate that their appliances
are able to hold and transfer all data in a secure manner.
 Service providers should deploy any and all appliances in such a manner that all access
to the appliances can be controlled, logged, and reported.

Service providers should be able to validate that their appliances have the ability to
ensure for the permanent destruction/deletion of all data on the device upon request,
as well as at the end of an assessment.