Understanding the policies of cloud providers – Almost all public cloud providers (aws cloud, google or azure services) have cloud pen testing processes in place. This is often known as the customer support policy for penetration testing cloud. This policy defines explicitly what activities are permitted and prohibited under cloud penetration testing exercise in their environment.

It is similar to other policies such as network stress testing, DDoS simulation testing. Examples of these cloud penetration test rules of engagement (such as Microsoft, Amazon Web Services, Google or Oracle Cloud Security Testing) or permission policies are available on cloud provider portals.

Businesses looking to conduct testing cloud penetration testing (or security assessments) should have a cloud penetration test plan in place. This plan should include information related to applications, data access, network access, laws & regulations to comply with the cloud application security testing or databases and assessment approach (white box, grey box or black box). See our in-depth article for the basics of security reviews.

Constantly identifying vulnerabilities in cloud environments is very important. Cloud penetration testing ensures that no blind spots (such as vulnerabilities in the virtual machines facing the Internet) are present in your environment.

The right toolset (whether automated tools for vulnerability scanning or manual checks) is an important component of advisory services just like on-premises for cloud application security testing or a security audit. Both cloud and on-premises tools are available, and a thorough requirements analysis should be performed to finalise the correct approach.

This phase is relevant to the previous one based on the tools and resources used. Correct tooling and security resource usage are the two most important aspects of vulnerability identification and analysis.

Using in-house teams to perform cloud penetration testing may miss certain findings due to close familiarity with the cloud environment. Cloud testing with the right cloud service provider is not an option these days, it’s the surest way to prove that your cloud assets are securing the underlying data.

Risk remediation is an important element, that feeds back into the risk management programme of an organisation. All risk advice is provided in our deliverables after cloud pentesting services and cloud environment to help the security team analyse and devise remediation plans. It includes a description of risks in the context of the environment, followed by attack probability and impact.

If required, Cyphere provides additional remediation consultancy given the complexity around risk and specific skill-set required for risk remediation of cloud penetration testing findings.