Cloud Security VAPT
Overview
Most of the web applications are moving to cloud technology. While this enhances the appliaction functionality, it also introduces security issues. Since everything is virtual in case of a cloud hosting, it is difficult to gain fine grain control of the "data at rest" and "data in transit".
Cloud computing technology offers three basic models of implementation.. Infrastructure as a service (IaaS), Software as a Service (SaaS) and Platform as a Service (PaaS). Securing cloud environments is a sweeping proposition that touches on the topics of virtualization security, access control, data protection and a host of other areas.
Some Facts
HOW DO WE SECURE CLOUD APPLICATIONS?
Valency Networks possesses years of security experience ranging from corporate networks to recent customers requiring cloud computing security. Unlike most other security consultancy offerings, in case of cloud security the approach is purely from design perspective.
We deep dive into the cloud architecture, and identify various attack vectors which range from network layer of cloud design, to the cloud aware applications running on virtual data centers or virtual development centers. Cloud security also includes that of web authentication portals which call the cloud service providers API calls. Customers of Valency Networks involve us right from design phase, to the implementation phase.
What is cloud security testing?
Most of the applications these days are hosted in the Cloud. Security is one of the major problems for applications. Cloud security testing has become a new service model where the security-as-a-service providers perform on-demand application security testing in the cloud.
The main objective of Cloud security is to stop any threat or malware from accessing, stealing or manipulating any of our private data. It identifies the threats in the system and measures its potential vulnerabilities and risks. It also helps developers in fixing those problems through coding. The cloud security testing is applicable for large application base, applications with low to medium risk and organizations with a strict budget & time restrictions.
Cloud Security Testing gives the feasibility to host the security testing tools on the Cloud for testing. With this process, tools on the Cloud can test the applications. In the traditional testing, one needs to have on-premise tools and infrastructure. Since Cloud-based testing techniques, make the process faster, and cost-effective, enterprises these days are adopting Cloud Security Testing.
Types of Security Testing in Cloud (AWS, Azure, Google)
The whole cloud testing is segregated into four main categories
- Testing of the whole cloud: The cloud is viewed as a whole entity and based on its features testing is carried out. Cloud and SaaS vendors, and the end users, are the ones who usually carry out this type of testing.
- Testing within a cloud: By checking each of its internal features, testing is carried out. The cloud vendors are the only ones who can perform this type of testing.
- Testing across cloud: Testing is carried out on different types of cloud-like private, public and hybrid clouds
- SaaS testing in cloud: Functional and non-functional testing is carried out on the basis of application requirements
| Types of Cloud Testing | Task Performed |
| SaaS or Cloud-oriented Testing | This type of testing is usually performed by cloud or SaaS vendors. The primary objective is to assure the quality of the provided service functions offered in a cloud or a SaaS program. Testing performed in this environment is integration, functional, security, unit, system function validation and Regression Testing as well as performance and scalability evaluation. |
| Online based application testing on a cloud | Online application vendors perform this testing that checks performance and Functional Testing of the cloud-based services. When applications are connected with legacy systems, the quality of the connectivity between the legacy system and under test application on a cloud is validated. |
| Cloud-based application testing over clouds | To check the quality of a cloud-based application across different clouds this type of testing is performed. |
Example Test cases for Cloud Testing
| Test Scenarios | Test case |
| Performance Testing | Failure due to one user action on the cloud should not affect other users performance Manual or automatic scaling should not cause any disruption On all types of devices, the performance of the application should remain the same Overbooking at supplier end should not hamper the application performance |
| Security Testing | An only authorized customer should get access to data
Data must be encrypted well Data must be deleted completely if it is not in use by a client Data should be accessible with insufficient encryption Administration on suppliers end should not access the customers' data Check for various security settings like firewall, VPN, Anti-virus etc. |
| Functional testing | Valid input should give the expected results Service should integrate properly with other applications A system should display customer account type when successfully login to the cloud When a customer chose to switch to other services the running service should close automatically |
| Interoperability & Compatibility Testing | Validate the compatibility requirements of the application under test system Check browser compatibility in a cloud environment Identify the Defect that might arise while connecting to a cloud Any incomplete data on the cloud should not be transferred Verify that application works across a different platform of cloud Test application on the in-house environment and then deploy it on a cloud environment |
| Network Testing | Test protocol responsible for cloud connectivity Check for data integrity while transferring data Check for proper network connectivity Check if packets are being dropped by a firewall on either side |
| Load and Stress Testing | Check for services when multiple users access the cloud services Identify the Defect responsible for hardware or environment failure Check whether system fails under increasing specific load Check how a system changes over time under a certain load |
Challenges in Cloud Testing
- Challenge#1: Data Security and Privacy Since Cloud applications multi-tenant in nature, risk of data theft always remain. For this reason suppliers should be give users an assurance about the safety of their data.
- Challenge#2: Short notice period This is a big problem when one manually validates the changes to the SaaS application, as Cloud provider give a short notice period of (1-2 weeks) to the existing customers about upgrades.
- Challenge#3: Validating interface compatibility At times, along with the upgrade in Cloud service provider, the external interface also gets upgraded which becomes a challenge for those subscribers who are used to the older interface. Cloud (SaaS) subscribers need to ensure that the users can choose the interface version they wanted to work
- Challenge#4: Data Migration Data migration from one Cloud provider to another is a huge challenge as both providers may have different database schemas and it requires a lot of effort to understand the data fields, relationships and how are they mapped across SaaS application
- Challenge#5: Enterprise Application Integration Enterprise application integration requires data integration validation of both outbound and inbound data, from client network to SaaS application and vice versa. Data privacy calls for a thorough validation in order to ensure SaaS subscribers about security and privacy of data.
- Challenge#6: Simulating live upgrade testing One of the biggest challenge in cloud testing is to ensure that live upgrades do not impact the existing connected SaaS users.
Cloud Application Penetration Tesing
CLOUD SECURITY
To manage cloud security in today's world, you need a solution that helps you address threats to enterprise data and infrastructure, including the major trends you are up against.
Changing attackers and threats:
Threats are no longer the purview of isolated hackers looking for personal fame. More and more, organized crime is driving well-resourced, sophisticated, targeted attacks for financial gain.
Consumerization
of IT
As mobile devices and technologies continue to proliferate, employees want to use personally owned devices to access enterprise applications, data, and cloud services.
Evolving architecture technologies
With the growth of virtualization and the use of public clouds, perimeters and their controls within the data center are in flux, and data is no longer easily constrained or physically isolated and protected.
Dynamic and challenging regulatory environment
Organizations and their IT departments often face ongoing burdens of legal and regulatory compliance with increasingly prescriptive demands and high penalties for noncompliance or breaches.
AWS CLOUD SECURITY
Amazon Web Services (AWS) provides an easy-to-manage cloud platform to store your digital assets, host servers and more. Its simple client interface in tandem with extensive documentation makes it a popular choice amongst developers to host their applications.
Amazon also has many settings for security controls including firewalls to block incoming and outgoing traffic and different identity and access management (IAM) accounts with varying levels of privileges. However, misconfigurations in your web application can allow an attacker to pivot into your cloud and exfiltrate both company and consumer data.In the past, developers used hard-coded passwords to access different services, such as MySQL or FTP, to retrieve client data.
