Cloud Security Audit consists of an audit that analyzes the cloud infrastructure configurations from a security point of view to ensure the necessary protection standards in these platforms and put in the spotlight the configurations that could represent a risk for the client, describing the problem, pointing out the affected resources and offering solutions for its mitigation.
To do this, we review the configuration of hundreds of elements that form the infrastructure, including access controls, roles and permissions, storage systems, network components or deployed instances, among others.
Careful, cyber security in the cloud is your responsibility
Cloud providers work under a “shared responsibility model”, where companies must take responsibility for cybersecurity. The responsibility is different depending on whether you have an IaaS, PaaS and SaaS model, below we show the responsibilities of each party when what you hire is the Cloud infrastructure, as is the case with AWS, Microsoft Azure, Google Cloud, etc:
Responsibility of your Cloud provider
Physical part of the infrastructure
- Device failures
- Physical access
- Network failures
- Other physical aspects of the infrastructure
* These responsibilities apply to “Infrastructure as a Service IaaS” services. In this link you can see the responsibilities that apply to PaaS and SaaS infrastructures.
Your responsibility as a Cloud customer
Virtual part of the infrastructure
- Identity and access control
- Operating system, network and firewall configurations
- Data stored by the customer
- Encryption of information in transit or at rest
- Other aspects concerning the use of the Cloud
* These responsibilities apply to “Infrastructure as a Service IaaS” services. In this link you can see the responsibilities that apply to PaaS and SaaS infrastructures..
How does a Cloud security audit differ from an infrastructure pentest?
The focus between the two cases is different, while the infrastructure pentest focuses on externally visible assets, exposed resources and how they can pose a risk to the infrastructure, the cloud security audit is based on the review of all configurations, security measures, open ports, permissions, etc.
The latter also reports on the risks to the cloud infrastructure, it doesn’t attack the infrastructure, although in neither case does it pose a real risk.
On which platforms do we analyze cloud security?
Amazon AWS
Microsoft Azure
Google Cloud
Oracle Cloud
Alibaba Cloud
Cloud security analysis for certifications
Cloud Security Audit has specific versions to adapt to the following certifications:
* Our team is working on new certifications that will be added soon. If you require a cloud pentest on any platform that is not listed, consult our specialists.
Other types of Security Audits
Pentest
A pentest consists of an IT security audit in which the company’s systems are attacked through the different breaches detected, analyzing how far a real attacker could gain access.
Source Code Audit
In a Source Code Audit we evaluate the degree of security of the source code of the applications used or developed by your company in search of vulnerabilities that could be exploited by attackers.
Social Engineering Audit
The purpose of this audit is to obtain confidential information from the company’s employees using the same methodologies used by cybercriminals to extract information without the employee being aware that he or she is compromising the company.