Cloud, Kubernetes and Infrastructure Security
Cloud Penetration Testing
Starting from a leaked key or compromised workload, we test how far an attacker could move in your cloud account. We measure whether your defenses detect this activity.
What it is
A cloud penetration test uses real steps to check the paths found in a configuration review. The test starts from a typical attacker entry point, such as an internet-facing application, a server or a developer's access key. You see, with evidence, which weakness actually leads to data.
Scope
- Written agreement on the starting point, objectives and forbidden steps
- Internet-facing cloud services and serverless functions
- Privileges obtainable through workload identities
- Role assumption and privilege escalation paths
- Attempts to access storage, databases and secret vaults
- Whether cloud security services and the SOC detect these steps
The need
When organizations need it
- When you want to see if the paths found in a configuration review can actually be used.
- Before a new platform holding customer data goes live in the cloud.
- When your cardholder data environment runs in the cloud. PCI DSS requires internal and external penetration tests at least every 12 months and after significant changes.
Method
How we work
-
Scenario and rules
We define the starting point, objectives and forbidden steps with you in writing.
-
Discovery
We identify the resources and privileges visible to the starting identity or workload.
-
Progression
We test the paths to the objective in controlled steps and log each step with a timestamp.
-
Comparison
We compare our records with what your cloud security services and SOC detected.
Outcome
What you have at the end
You see what an attacker could actually reach in your cloud account and which steps went undetected. Fixes that block the paths and missing alerts are listed in order of priority.
Frequently asked questions
Do we need permission from the cloud provider?
AWS, Azure and Google Cloud allow customers to test their own resources without prior approval if they follow the published rules. For example, denial of service (DoS) testing is prohibited under AWS and Azure rules.
Is the test performed in production?
For realistic results, production accounts are usually tested. Steps that could change data or cause downtime are taken only with your approval.
Cloud, Kubernetes and Infrastructure Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting