Cloud and Identity Security
Cloud, Kubernetes and Infrastructure Security
In the cloud, the provider secures the infrastructure. Identities, permissions and configuration are your responsibility. We examine roles in your AWS, Azure, Google Cloud and Kubernetes environments. We show the reach of a single incorrect permission.
Cloud, Kubernetes and Infrastructure Security
In the cloud, permissions change as frequently as code. Permissions that seem harmless alone can combine to allow full account access. One role being able to assume another is enough. A single leaked access key can reach data without crossing any network boundary.
The need
When organizations need it
- After migrating to the cloud, before temporary permissions from the initial setup become permanent.
- When your cloud accounts increase and trust relationships between them become complex.
- Before launching a customer-facing application on Kubernetes.
- When an auditor or regulator requests an independent assessment of your cloud environment.
Questions
What this work answers
- Do our cloud accounts have identities with more privileges than necessary?
- Which data could be accessed with a leaked access key?
- Could a compromised workload spread within the Kubernetes cluster and to other accounts?
- Could we access the required logs and evidence during an incident?
Cloud, Kubernetes and Infrastructure Security
What we do
-
AWS, Azure and Google Cloud Assessment
We review configurations and roles in your accounts using realistic compromise scenarios.
-
Cloud IAM and Privilege Analysis
We map excessive permissions and attack paths formed by role assumption chains.
-
Kubernetes Security Assessment
We review cluster configuration, RBAC permissions and network policies.
-
Container Runtime Security
We review container permissions and isolation. We assess the risk of escaping from a container to the host.
-
Cloud Network Architecture and Segmentation
We review inter-network access and whether management interfaces are separated from the internet.
-
Storage, Database and Backup Security
We review access and encryption controls on storage and databases. We check if an attacker could delete your backups.
-
Secrets and Key Management
We review where keys and passwords are stored and who can access them. We check how often they are rotated.
-
Microsoft 365 and SaaS Security
We review tenant settings and external sharing. We check permissions granted to third-party applications.
-
Server and Operating System Hardening
We remove unnecessary services and accounts. We bring servers to an approved security configuration.
-
Cloud Incident Response Readiness
We prepare in advance the logs and isolation permissions needed during an incident.
-
Hybrid Infrastructure Security Architecture
We assess identity synchronization and trust relationships between on-premises systems and the cloud.
-
Cloud Penetration Testing
We test how far an attacker could progress in a cloud account with a leaked key.
Scope
AWS, Azure and Google Cloud accounts, Kubernetes clusters, Microsoft 365 and on-premises links. The review starts with a read-only account. Active testing steps are approved separately.
How we work
Instead of listing findings individually, we map privilege chains. A chain extends from an identity to a sensitive resource. With your approval, we test critical chains in a controlled manner.
Deliverables
What you receive
Privilege chains from an identity to a sensitive resource. The smallest permission change to break each chain. Configuration corrections prioritized.
NoteWhen cloud and identity assessments are combined, paths from an on-premises account to cloud data are also visible.
Related services
Request Cloud Assessment
Tell us your objective and critical systems. We will settle the right scope in the first meeting.
Schedule a Meeting