AWS Cloud Penetration Testing – What you should know about it?

Types of AWS Pen Testing

As already discussed, AWS has a shared responsibility model. This divides the responsibility of the security procedure such as Pen Testing as well.

1. Security of Cloud: This responsibility falls in the bucket of AWS. It involves making the cloud platform safe and secure for the users of the AWS services. The logic flaws and all zero days hackers can exploit to AWS server performance must be addressed.
2. Security in the Cloud: This is the aspect of AWS cloud security where the user is responsible. Here, the company or individual using the AWS cloud must ensure the safety of the data, applications, and other assets stored on the cloud. Users can make double sure by deploying professional security protocols on the AWS cloud assets.

List of AWS Controls You can Test for Security

Governance:

• Identify assets & define AWS boundaries
• Identify, review & evaluate risks
• Understand AWS usage/implementation
• Access policies
• Add AWS to risk assessment
• IT security & program policy
• Documentation and Inventory

Network Management:

• Environment Isolation
• Granting & revoking accesses
• Network Security Controls
• Documentation and Inventory
• Physical links
• Malicious code controls
• DDoS layered defense

Encryption Control:

• IPSec Tunnels
• AWS API access
• SSL Key Management
• AWS Console access
• Protect PINs at rest

Logging and Monitoring:

• Review policies for ‘adequacy’
• Aggregate from multiple sources
• Review Identity and Access Management (IAM) credentials report
• Centralized log storage
• Intrusion detection & response

The areas of AWS Cloud where you cannot perform Pen Testing

• The physical hardware that belongs to AWS
• AWS-controlled servers
• Relational Database Service (RDS) of Amazon
• Other vendors’ EC2
• Security appliances managed by other vendors

Steps you need to take before AWS Pen Testing

• Decide your target systems for the test and define the scope.
• Run preliminary operations on your own.
• Select the type of security test you are going to conduct.
• Prepare an outline of expectations of stakeholders from the penetration test.
• Set a definite timeline for the test procedure.
• Get written approval from all the concerned parties involved with the cloud.