Cloud Penetration Testing

A cloud penetration test focuses on your cloud environment and any services hosted within Amazon Web Service (AWS), Google Cloud Platform (GCP), Microsoft Azure, Oracle Cloud Infrastructure (OCI), and other providers.

Contact a Specialist Read More About Schellman's Approach

A Cloud Penetration Test Can Help You:

https://www.schellman.com/hubfs/improve-security-posture-2.svg

Improve Your Security Posture

This assessment will discover credential exposures within services that allow for privilege escalation or situations where identity and access management allow excessive access to resources.

Prepare for Real-World Attacks

Because this test provides a simulation of real-world attacks, you’ll be able to see how an attacker would move laterally through

https://www.schellman.com/hubfs/meet-compliance-requirements.png

Demonstrate Compliance

Depending on your industry and related regulations, a cloud penetration test may benefit your compliance purposes.

https://www.schellman.com/hubfs/improve-security.png

Provide a Sense of Security

While built-in security tools exist with many providers, you’ll get a more thorough picture of your cloud assets, including how attack-resistant and vulnerable they are. Verifying the security will enable you to have confidence in the cloud security posture and allows you to demonstrate this to customers, partners, and stakeholders.

Identify Security Vulnerabilities in Your Cloud Resources

These vulnerabilities are often different than those found via automated scanning and other audit-focused tools—finding them will reduce your associated risks, including those that will accompany any potential acquisition of a new company that heavily uses the cloud.

Schellman’s Cloud Penetration Testing Methodology

While this test type does include common pen test attack vectors, it also involves techniques unique to cloud environments such as the exploitation of misconfigured serverless components and privilege escalation paths within native cloud services.

Our cloud penetration testing methodology involves the following steps:

1. Provision (Seed) Initial Access: With your help, we’ll create users, or API keys that have the same rights as a standard employee, developer, or an account with read-only access to the environment to be tested.

2. Identify Best Practices: Then, we’ll identify common best practices that are abused by attackers. (NOTE: Despite our efforts, this phase will likely not identify as many best practice-related items as might be found during an audit due to the latter’s focus on manual processes and review.)

3. Privilege Escalation: Finally, we’ll begin searching through accessible services (e.g., compute, storage, IAM, etc.) in your cloud environment and identify credentials and misconfigurations that might help us gain additional access beyond that which has been granted. Each time we gain access to a new principal or service within the cloud environment we’ll pinpoint just how much new access to resources was obtained and how these resources can be abused further to gain additional access and/or compromise your additional resources.

Is Schellman the Right Firm for You?

Schellman does perform cloud penetration testing—our Penetration Testing Team continues to grow and is currently comprised of individuals from different backgrounds including former developers, system administrators, and lifelong security professionals. Our team is incredibly experienced, and collectively holds the following professional certifications, among others: