Cloud Penetration Testing Checklist – 2023

Cloud Penetration Testing is a method of actively checking and examining the Cloud system by simulating the attack from the malicious code.

Cloud computing is the shared responsibility of the Cloud provider and the client who earn the service from the provider.

Due to the impact of the infrastructure, Penetration Testingnot allowed in SaaS Environment.

Cloud Penetration Testing is allowed in PaaS, and IaaS with some Required coordination.

Regular Security monitoring should be implemented to monitor the presence of threats, Risks, and Vulnerabilities.

SLA contract will decide what kind of pentesting should be allowed and How often it can be done.

Important Cloud Penetration Testing Checklist:

1. Check the Service Level Agreement and make sure that proper policy has been covered between the Cloud service provider (CSP) and Client.
2. To maintain Governance & Compliance, check the proper responsibility between the Cloud service provider and the subscriber.
3. Check the service level agreement Document and track the record of CSP to determine the role and responsibility to maintain the cloud resources.
4. Check the computer and Internet usage policy and make sure it has been implemented with proper policy.
5. Check the unused ports and protocols and make sure services should be blocked.
6. Check the data which is stored in cloud servers is Encrypted by Default.
7. Check the Two Factor Authentication used and validate the OTP to ensure network security.
8. Check the SSL certificates for cloud services in the URL  and make sure certificates purchased from repudiated Certificate Authority (COMODO, Entrust, GeoTrust, Symantec, Thawte etc.)
9. Check the Component of the access point, data center, and devices, using Appropriate security Control.
10. Check the policies and procedures for Disclosing the data to third parties.
11. Check if CSP offers cloning and virtual machines when Required.
12. Check the proper input validation for Cloud applications to avoid web application Attacks such as XSS, CSRF, SQLi, etc.

Cloud Computing Attacks:

Session Riding ( Cross-Site Request Forgery)

CSRF is an attack designed to entice a victim into submitting a request, which is malicious in nature, to perform some task as the user.

Side Channel Attacks

This type of attack is unique to the cloud and potentially very devastating, but it requires a lot of skill and a measure of luck.

This attack attempts to indirectly breach a victim’s confidentiality by exploiting the fact that they are using shared resources in the cloud.

Signature Wrapping Attacks

Another type of attack is not exclusive to a cloud environment but is nonetheless a dangerous method of compromising the security of a web application.

Basically, the signature wrapping attack relies on the exploitation of a technique used in web services.

Other Attacks in Cloud Environment:

Important Considerations of Cloud Penetration Testing:

1. Performing the Vulnerability Scanning in the available host in Cloud Environment
2. Determine the Type of Cloud, whether it is SaaS or IaaS, or PaaS.
3. Determine what kind of testing the Cloud Service provider permits.
4. Check the Coordination, scheduling, and performing of the test by CSP.
5. Performing Internal and External Pentesting.
6. Obtain Written consent for performing the pentesting.
7. Performing the web pentesting on the web apps/services without Firewall and Reverse Proxy.

Important Recommendation for Cloud Penetration Testing:

1. Authenticate users with Username and Password.
2. Secure the coding policy by giving attention to the Services Providers’ Policy.
3. A strong Password Policy must be Advised.
4. Change Regularly by Organization, such as user account name and a password assigned by the cloud Providers.
5. Protect the information that is uncovered during the Penetration Testing.
6. Password Encryption Advisable.
7. Use centralized Authentication or single sign-on for SaaS Applications.
8. Ensure the Security Protocols are up-to-date and Flexible.

SOASTA CloudTest:

This suite can enable four types of testing on a single web platform: mobile functional and performance testing and web-based functional and performance testing.

LoadStorm:

LoadStorm is a load-testing tool for web and mobile applications and is easy to use and cost-effective.

BlazeMeter:

BlazeMeter is used for end-to-end performance and load testing of mobile apps, websites, and APIs.

Nexpose:

Nexpose is a widely used vulnerability scanner that can detect vulnerabilities, misconfiguration, and missing patches in a range of devices, firewalls, virtualized systems, and cloud infrastructure.

AppThwack:

AppThwack is a cloud-based simulator for testing Android, iOS, and web apps on actual devices. It is compatible with popular automation platforms like Robotium, Calabash, UI Automation, and several others.

Top 10 Cloud Penetration Testing Checklist

A Cloud Penetration Testing Checklist for 2024 should encompass the latest security trends, technologies, and compliance requirements. Cloud penetration testing focuses on identifying and exploiting vulnerabilities in cloud environments, ensuring they align with the latest security best practices.

1. Pre-Engagement Phase

• Scope Definition:
  • Define the cloud environment and assets under test (e.g., AWS, Azure, GCP, SaaS applications).
  • Specify cloud services to be tested (e.g., VMs, databases, storage, containers).
  • Agree on a clear set of test goals, including legal and compliance boundaries.
• Get Permissions:
  • Ensure written consent is obtained from the cloud provider if testing a third-party cloud (e.g., AWS, Azure, GCP).
  • Verify that testing won’t violate the cloud provider’s terms of service.
• Data Sensitivity:
  • Identify critical and sensitive data within the scope.
  • Classify data based on compliance requirements like GDPR, HIPAA, or SOC2.

2. Information Gathering

Identify Cloud Services:

Identify and map out all the cloud services (IaaS, PaaS, SaaS) in use.

DNS and Subdomain Enumeration:

Enumerate public-facing domains and subdomains.

Public Cloud Footprint:

Identify exposed IP addresses, services, APIs, and endpoints.

Analyze cloud infrastructure metadata for exposed data (e.g., AWS S3 bucket policies, Azure Blob Storage settings).

Cloud Provider Specific Reconnaissance:

AWS: Enumerate IAM roles, S3 buckets, Lambda functions, and EC2 instances.

Azure: Check AD, Key Vaults, and role-based access control (RBAC) policies.

GCP: Examine IAM permissions, storage buckets, and Cloud Functions.

3. Identity and Access Management (IAM)

User Access Review:

Check for unused or inactive users and permissions.

Review the principle of least privilege (PoLP) and ensure all users only have the necessary access rights.

Role & Policy Review:

Identify misconfigured roles or policies allowing excessive access.

Check for open or public roles that might give unauthorized access.

Authentication Mechanisms:

Test the strength of password policies and MFA enforcement.

Test Single Sign-On (SSO) implementations, OAuth, OpenID Connect.

Privileged Escalation Paths:

Identify users with excessive privileges and test for privilege escalation attacks (e.g., AWS “AssumeRole” or Azure “Contributor”).

4. Network Security

Network Architecture Review:

Evaluate VPCs (Virtual Private Clouds) and network segmentation.

Check security group configurations (AWS Security Groups, Azure NSGs).

Publicly Accessible Resources:

Identify public-facing instances (e.g., EC2, App Services) and confirm the exposure is justified.

Verify firewall rules for incoming and outgoing traffic, ensuring they are minimal and appropriate.

Cloud Load Balancers & CDN:

Test load balancers, CDN configurations, and related security features like TLS offloading.

VPNs and Direct Connections:

Verify that VPNs or DirectConnect/ExpressRoute setups are secure.

5. Storage and Data Security

Access Control:

Check for public or misconfigured storage buckets (AWS S3, Azure Blob, GCP Buckets).

Verify that sensitive data (e.g., PII, financial) is not stored in public or insecure areas.

Encryption:

Ensure encryption is enforced both at rest and in transit.

Validate proper key management practices (e.g., AWS KMS, Azure Key Vault).

Data Retention and Backup:

Evaluate backup configurations and retention policies.

Test the security of backup systems and ensure they are not exposed to the public internet.

6. Compute & Container Security

Virtual Machines:

Check for outdated or unpatched operating systems.

Test for vulnerabilities like misconfigured SSH or RDP access, or improper firewall configurations.

Container Security:

Test security of container orchestration platforms like Kubernetes (K8s).

Check for misconfigurations in container registries, images, and permissions.

Identify excessive container privileges (e.g., root access).

Serverless Architectures:

Test functions-as-a-service platforms like AWS Lambda, Azure Functions.

Ensure minimal privileges and correct IAM policies for serverless functions.

7. Application Security

API Security:

Identify exposed APIs and assess their authentication and authorization mechanisms.

Test for common API vulnerabilities (e.g., Broken Object-Level Authorization, Insecure API Keys).

Web Applications:

Perform standard web app testing (e.g., OWASP Top 10).

Assess the use of cloud-specific services like AWS API Gateway or Azure App Services.

CI/CD Pipelines:

Test for weak points in CI/CD pipelines that may lead to deployment of insecure code.

Ensure proper use of cloud-native CI/CD tools like AWS CodeBuild, Azure DevOps.

8. Compliance and Logging

Cloud Provider Logging and Monitoring:

Verify the proper configuration of logging services (e.g., AWS CloudTrail, Azure Monitor, GCP Stackdriver).

Ensure that logs are being monitored in real-time and are accessible for incident response.

Auditing Access and Activities:

Check if audit trails are enabled for user and admin activities.

Ensure logs are centralized, encrypted, and retained as per compliance requirements.

Security Incident and Event Management (SIEM):

Test the integration of SIEM solutions with cloud environments.

Ensure alerts and response mechanisms are in place for suspicious activities.

9. Third-Party Integrations

Assess Third-Party Tools:

Evaluate security of any third-party integrations or tools that access the cloud environment (e.g., monitoring tools, CRMs).

Supply Chain Attacks:

Test for supply chain vulnerabilities, including in software dependencies and external services.

Shared Responsibility Model:

Review and ensure proper understanding and coverage of security responsibilities between the cloud provider and the customer.

10. Post-Engagement and Reporting

Findings Report:

Create a detailed report summarizing findings, risks, and potential impacts.

Include remediation recommendations, prioritizing high-risk vulnerabilities.

Retest & Validate:

Conduct a follow-up test to validate that vulnerabilities have been resolved.

Continuous Monitoring & Training:

Recommend continuous monitoring strategies and employee security awareness training.