You have been asked to perform a penetration test, security assessment, maybe an Attacker Simulation or a red team exercise. The environment in question is mainly cloud-focused. It could be entirely cloud-native for the service provider or Kubernetes-based. Perhaps the environment in question is even multi-cloud, having assets in both Amazon and Azure. SEC Cloud Penetration Testing will teach you the latest penetration testing techniques focused on the cloud and how to assess cloud environments.
Computing workloads have been moving to the cloud for years. Analysts predict that most, if not all, companies will have soon have workloads in public and other cloud environments. While organizations that start in a cloud-first environment may eventually move to a hybrid cloud and local data center solution, cloud usage will not decrease significantly.
So when assessing risks to an organization going forward, we need to be prepared to evaluate the security of cloud-delivered services. The most commonly asked questions regarding cloud security when it comes to penetration testing are: Do I need to train specifically for engagements that are cloud-specific? In cloud-service-provider environments, penetration testers will not encounter a traditional data center design, there will be new attack surface areas in the service control planes of these environments.
Learning how such an environment is designed and how you as a tester can assess what is in it is a niche skill set that must be honed. What we rely on to be true in a classical data center environment such as who owns the Operating System and the infrastructure and how the applications are running will likely be very different.
Applications, services, and data will be hosted on a shared hosting environment unique to each cloud provider. SEC Cloud Penetration Testing draws from many skill sets required to assess a cloud environment properly.
