- [Instructor] Whenever you perform
penetration testing in the cloud,
you must understand
what you can and you cannot do in that cloud environment.
Most of the cloud service providers that are mature,
you know, the biggest one out there,
have detailed guidelines on how to perform
security assessments and penetration testing in the cloud.
Now, regardless, there are many potential threats
when organizations move to a cloud model.
For instance, although your data is actually in the cloud,
it actually has to reside somewhere, right?
In a physical location somewhere.
So, your cloud provider should agree, in writing,
to provide the level of security required
for your customers, right?
And, you know, for your organization.
Now, these are a few questions that
most people in the industry asked cloud providers
before they actually signed their contract.
And, you know, they contract them for their services.
First one is actually, you know,
who has access to the data, right?
Access control is a key concern
because even insider attacks
are actually a huge risk nowadays,
even in the cloud environment.
The other thing is that,
what are the providers regulatory requirement?
And especially organizations operating in different,
you know, geographical locations like the U.S., Canada,
European Union, and Asia, must,
you know, abide by different regulatory requirements
that may be specific for those areas.
The other question is, do you have the right to audit?
What type of training
does the provider offer to the employee?
What type of data classification system
does the provider use?
You know, how's your data separated from other users' data?
And is the data on, you know, a shared server
or a dedicated server that they actually may have?
And of course, you know, if it's on a dedicated server,
or a dedicated system, they may actually,
you know, charge extra.
But those are actually some requirements that you must,
you know, explore
before you actually sign a contract, right?
Now is encryption being used, right?
Not only encryption during transit, right?
But also, is data encrypted at rest in the cloud?
And also, what are the crypto algorithms and implementations
that the cloud provider, you know, uses, right?
Who maintains control of the encryption key?
Is it gonna be your company,
or is it gonna be the cloud provider?
Also, what are the service level agreements, or SLA?
You know, different terms that you, you know, must abide.
And the cloud provider also should agree
and guarantee the service, you know, between them and,
you know, you as a consumer.
Also, will they assume liability in the case of a breach?
What is the disaster recovery and business continuity plan
that the cloud provider actually has?
So, all those are different questions that you must ask
whenever, you know, not only for performing
a security assessment, but overall, you know,
how they actually perform a security assessment
in their infrastructure as well.