CLOUD

PENETRATION TESTING

Testing the Cloud

Cloud Intrusion

Majority of organizations believe that moving to a cloud-based architecture removes risks and vulnerabilities that curse traditional network environments. Unfortunately, this is not the case as traditional security measures prove no longer to be effective at managing a cloud environment. Migrating to a cloud architecture exposes a new level of threats to the cloud environment. As a result all organizations leveraging the cloud must perform comprehensive penetration testing of all cloud infrastructures.

Cloud service providers (CSPs), including IaaS, PaaS, SaaS, and hybrid, and the organizations that use these services are faced with security challenges. CyberArq is here to assist.

Cloud Protection

CyberArq’s teams of experts are highly experienced and well versed in NIST 800-53 and Department of Defense requirements. We understand how these requirements relate to commercial cloud environments (AWS, Azure & GCP) and have incorporated this into all our engineering processes, ensuring our clients they can operate in the cloud with confidence.

CSP Penetration Attack Vectors

  • Attack the cloud environment from the Internet, emulating an anonymous attacker.
  • Attack the cloud environment from within the context of a customer’s access, emulating the impact a compromised customer system or partner network may have, by:
    • Escalating privileges within the customer environment.
    • Gaining access to CSP backbone infrastructure.
    • Compromising other cloud service tenants.
  • Attack the corporation by:
    • Gaining a foothold in the environment through social engineering.
    • Compromising systems to collect credentials that have access to the cloud environment.
    • Compromising systems to gain access to source code or other sensitive programming material.
  • Attack the cloud environment from the Internet, emulating an anonymous attacker.
  • Attack the cloud environment from within the context of a customer’s access, emulating the impact a compromised customer system or partner network may have, by:
    • Escalating privileges within the customer environment.
    • Gaining access to CSP backbone infrastructure.
    • Compromising other cloud service tenants.
  • Attack the corporation by:
    • Gaining a foothold in the environment through social engineering.
    • Compromising systems to collect credentials that have access to the cloud environment.
    • Compromising systems to gain access to source code or other sensitive programming material.

Cloud Consumer Penetration Attack Vectors​

  • For virtual private clouds, attack the cloud environment from the Internet, emulating an anonymous attacker.
  • Attack the cloud environment from within the context of an internally authenticated user, emulating the impact an internal threat to:
    • Escalate privileges within the cloud service.
    • Gain access to other backbone infrastructure.
  • Attack the corporation by:
    • Gaining a foothold in the environment through social engineering.
    • Compromising systems in the corporate environment with the goal of collecting credentials that have access to the cloud environment.
    • Compromising development and administrative systems to gain access to source code or other sensitive programming material.
  • For virtual private clouds, attack the cloud environment from the Internet, emulating an anonymous attacker.
  • Attack the cloud environment from within the context of an internally authenticated user, emulating the impact an internal threat to:
    • Escalate privileges within the cloud service.
    • Gain access to other backbone infrastructure.
  • Attack the corporation by:
    • Gaining a foothold in the environment through social engineering.
    • Compromising systems in the corporate environment with the goal of collecting credentials that have access to the cloud environment.
    • Compromising development and administrative systems to gain access to source code or other sensitive programming material.

When should my organization have a penetration test?

• Satisfy PCI, HIPAA and NERC-CIP compliance 
• Test your cyber-security controls after they mature
• To match up critical vulnerabilities with critical assets
• To identify all false-positives and false-negatives

• At least annually, recommended semi-annually
• After changes to your configurations or hardware
• Patch management remediation on discovered vulnerabilities
• AS OFTEN AS YOU LIKE

Penetration Testing Approach & Methodology

1. Define Scope

Detailed outline with the customer to define what assets are in scope.

5. Exploitation

Exploit vulnerabilities discovered in the vulnerability analysis stage with custom and generic exploitation scripts.

2. Information Gathering

Map out the corporate infrastructure based on services, ports, hardware, software and operating system. 

6. Post Exploitation

Successful exploitation’s lead to privilege escalation and new vulnerabilities to test for exploitation.

3. Threat Modeling

Determine mission critical and connected assets to corporate data through white, gray or black box approach.

7. Reporting

Creation of  Executive and Detail technical reports for both management and remediation team.

4. Vulnerability Analysis

Utilize enterprise and custom scanning tools to uncover vulnerabilities.

8. Exit Call

Call scheduled with customers management and remediation team to explain in detail the findings and assist in remediation processes.

1. Define Scope

Detailed outline with the customer to define what assets are in scope.

2. Information Gathering

Map out the corporate infrastructure based on services, ports, hardware, software and operating system. 

3. Threat Modeling

Determine mission critical and connected assets to corporate data through white, gray or black box approach.

4. Vulnerability Analysis

Utilize enterprise and custom scanning tools to uncover vulnerabilities.

5. Exploitation

Exploit vulnerabilities discovered in the vulnerability analysis stage with custom and generic exploitation scripts.

6. Post Exploitation

Successful exploitation’s lead to privilege escalation and new vulnerabilities to test for exploitation.

7. Reporting

Creation of  Executive and Detail technical reports for both management and remediation team.

8. Exit Call

Call scheduled with customers management and remediation team to explain in detail the findings and assist in remediation processes.

Why Choose CyberArq?

Cyber Arq’s industry leading security professionals are readily available to assist and recommend additional security methods to better protect your organizations cloud environment. Our experts will work with your organization team leads to stimulate either a real-life penetration testing scenario with zero knowledge known as blackbox, partial knowledge, known as graybox or with full information on the corporate cloud infrastructure disclosed to perform a whitebox assessment.

Advisory Solutions

VULNERABILITY ASSESSMENT

Network devices, Cloud infrastructure, Web applications, Wireless, Mobile applications and Internet of things devices

Learn More

PENETRATION TESTING

Network devices, Cloud, Wireless, Web application, Internet of things devices, Mobile applications, Social engineering, Continuous penetration testing and Active directory enumeration

Learn More

Your Trust, Our Protection

talk to a cyber security expert today!

Contact Us
Cyber Arq World Location in Gray and Red 2

Florida – USA | Sydney – Australia

CyberArq LLC

© 2024 All Rights Reserved

CyberArq LLC

© 2020 All Rights Reserved