Thursday, March 28, 2024

Cloud Penetration Testing Checklist – 2023

Cloud Penetration Testing is a method of actively checking and examining the Cloud system by simulating the attack from the malicious code.

Cloud computing is the shared responsibility of the Cloud provider and the client who earn the service from the provider.

Due to the impact of the infrastructure, Penetration Testingnot allowed in SaaS Environment.

Cloud Penetration Testing is allowed in PaaS, and IaaS with some Required coordination.

Regular Security monitoring should be implemented to monitor the presence of threats, Risks, and Vulnerabilities.

SLA contract will decide what kind of pentesting should be allowed and How often it can be done.

Important Cloud Penetration Testing Checklist:

important
  1. Check the Service Level Agreement and make sure that proper policy has been covered between the Cloud service provider (CSP) and Client.
  2. To maintain Governance & Compliance, check the proper responsibility between the Cloud service provider and the subscriber.
  3. Check the service level agreement Document and track the record of CSP to determine the role and responsibility to maintain the cloud resources.
  4. Check the computer and Internet usage policy and make sure it has been implemented with proper policy.
  5. Check the unused ports and protocols and make sure services should be blocked.
  6. Check the data which is stored in cloud servers is Encrypted by Default.
  7. Check the Two Factor Authentication used and validate the OTP to ensure network security.
  8. Check the SSL certificates for cloud services in the URL  and make sure certificates purchased from repudiated Certificate Authority (COMODO, Entrust, GeoTrust, Symantec, Thawte etc.)
  9. Check the Component of the access point, data center, and devices, using Appropriate security Control.
  10. Check the policies and procedures for Disclosing the data to third parties.
  11. Check if CSP offers cloning and virtual machines when Required.
  12. Check the proper input validation for Cloud applications to avoid web application Attacks such as XSS, CSRF, SQLi, etc.

Cloud Computing Attacks:

attacks

Session Riding ( Cross-Site Request Forgery)

CSRF is an attack designed to entice a victim into submitting a request, which is malicious in nature, to perform some task as the user.

Side Channel Attacks

This type of attack is unique to the cloud and potentially very devastating, but it requires a lot of skill and a measure of luck.

This attack attempts to indirectly breach a victim’s confidentiality by exploiting the fact that they are using shared resources in the cloud.

Signature Wrapping Attacks

Another type of attack is not exclusive to a cloud environment but is nonetheless a dangerous method of compromising the security of a web application.

Basically, the signature wrapping attack relies on the exploitation of a technique used in web services.

Other Attacks in Cloud Environment:

Important Considerations of Cloud Penetration Testing:

  1. Performing the Vulnerability Scanning in the available host in Cloud Environment
  2. Determine the Type of Cloud, whether it is SaaS or IaaS, or PaaS.
  3. Determine what kind of testing the Cloud Service provider permits.
  4. Check the Coordination, scheduling, and performing of the test by CSP.
  5. Performing Internal and External Pentesting.
  6. Obtain Written consent for performing the pentesting.
  7. Performing the web pentesting on the web apps/services without Firewall and Reverse Proxy.

Important Recommendation for Cloud Penetration Testing:

  1. Authenticate users with Username and Password.
  2. Secure the coding policy by giving attention to the Services Providers’ Policy.
  3. A strong Password Policy must be Advised.
  4. Change Regularly by Organization, such as user account name and a password assigned by the cloud Providers.
  5. Protect the information that is uncovered during the Penetration Testing.
  6. Password Encryption Advisable.
  7. Use centralized Authentication or single sign-on for SaaS Applications.
  8. Ensure the Security Protocols are up-to-date and Flexible.

Important Penetration Testing Tools

tools

SOASTA CloudTest:

This suite can enable four types of testing on a single web platform: mobile functional and performance testing and web-based functional and performance testing.

LoadStorm:

LoadStorm is a load-testing tool for web and mobile applications and is easy to use and cost-effective.

BlazeMeter:

BlazeMeter is used for end-to-end performance and load testing of mobile apps, websites, and APIs.

Nexpose:

Nexpose is a widely used vulnerability scanner that can detect vulnerabilities, misconfiguration, and missing patches in a range of devices, firewalls, virtualized systems, and cloud infrastructure.

AppThwack:

AppThwack is a cloud-based simulator for testing Android, iOS, and web apps on actual devices. It is compatible with popular automation platforms like Robotium, Calabash, UI Automation, and several others.

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles