Key Concepts for Pentesting Today’s Cloud Networks

Before you perform your first cloud pentest or red team engagement, there are some concepts you need to learn.

Cloud platforms have policies for pentesting that you and your organization must abide by. It’s also important to understand and verify network performance with benchmark checks. Services enumeration is a way an attacker can learn things about your organization’s public cloud services that can help them cyber-attack it.

Assure that your organization’s public cloud has performed vulnerability assessments and that common cloud misconfigurations are addressed before you pentest.

Resources provided by MITRE’s Common Vulnerabilities and Exposures (CVE) database, the National Institute of Standards and Technology’s (NIST’s) National Vulnerability Database (NVD) database, and the Forum of Incident Response and Security Teams’ (FIRST’s) Exploit Prediction Scoring...

Cloud platform policies, benchmark checks, and services enumeration

Pentesting cloud networks on public cloud platforms is fundamentally different from pentesting on your organization’s own premises and its own infrastructure.

If your organization owns the premises and infrastructure, it has the legal right to determine everything you’re allowed and forbidden to do to its network for your pentest. If I buy a house, as long as the laws in my municipality and country don’t forbid it, I could allow building contractors to replace walls, redo my roof, install new doors, and so on.

If I rent my house from a landlord, I don’t own my house. I would need my landlord’s permission if I wanted to pay building contractors to make those sorts of modifications to my house.

On Amazon Web Services (AWS), Azure, and Google Cloud Platform (GCP), your organization is “renting its house” from its “landlord”—Amazon, Microsoft...

Exposed services, permissions, and integrations

Every network should undergo vulnerability assessments before they’re pentested. Make sure the organization whose cloud network you’re pentesting has had some vulnerability assessments conducted recently.

A vulnerability assessment (sometimes called a vulnerability audit) is a systematic process where a checklist is used to identify common security weaknesses, misconfigurations, and other vulnerabilities pertaining to a type of computer system. A vulnerability assessment is a systematic process of identifying, analyzing, and prioritizing vulnerabilities in a system, network, or application. It involves scanning the system to identify existing weaknesses, flaws, or vulnerabilities that could be exploited by attackers. An old-fashioned vulnerability assessment may have a human network security specialist use a manual list of common vulnerabilities in a particular operating system or application and look through the software...

CVE, CVSS, and vulnerabilities

In cybersecurity, we have formal systems for classifying security vulnerabilities in networks and applications. Known vulnerabilities are recorded in MITRE’s Common Vulnerabilities and Exposures database, or CVE for short (https://www.cve.org/). CVE records are classified according to MITRE’s CVSS (https://nvd.nist.gov/vuln-metrics/cvss). Also, known exploits are classified with EPSS (https://www.first.org/epss/). MITRE ATT&CK is a database for classifying known exploits to computer systems and networks (https://attack.mitre.org/).

So, MITRE is the organization that helps cybersecurity professionals of all kinds understand vulnerabilities and exploits. The knowledge in MITRE’s databases grows constantly, every day. MITRE’s databases are on the web, freely available for anyone to use as a reference. As a cloud pentester, your job is to discover vulnerabilities and exploits in the cloud networks you test so that the organization...

Purple teaming and writing pentest reports

As a cloud pentester, you will spend anywhere from a few days to multiple months on a single engagement, whether you’re a third-party contractor to the organization you’re working for or a part of the organization’s internal red team. Your objective is to work within your organization’s contractually defined scope to find as many security vulnerabilities as you can while performing simulated cyber attacks your organization and the cloud providers (AWS, Azure, GCP) permit you to do.

So, over the course of those days, weeks, or months, you may have found several vulnerabilities. Most of them are vulnerabilities that the cybersecurity community is familiar with, with extensive records in the CVE database, NIST’s NVD, and in the security alerts and patch notes of the vendors (tech companies that provide products and services to your organization) to which the vulnerabilities you’ve found pertain. Maybe...

Summary

AWS, Azure, and GCP have pentesting policies that you and your organization must abide by. Benchmark checks verify the performance of your organization’s cloud services. Cloud provider SLAs are a good source of general benchmarks. CIS also has specific benchmarks for cybersecurity. Cloud service enumeration is a way that an attacker can find out information about how your organization uses cloud services. There are scripts you can execute to test your organization’s susceptibility to vulnerabilities.

Vulnerability assessments can be performed by vulnerability scanning applications. Before pentesting, it’s important to have a recent history of vulnerability assessments and mitigation for the findings of those assessments. Common security misconfigurations must be addressed first before your organization is ready to pentest.

Exposed services are internet services and ports in your organization’s cloud network that an attacker can use to cyber...

Further reading

To learn more on the topics covered in this chapter, you can visit the following links:

• Official AWS penetration testing policies: https://aws.amazon.com/security/penetration-testing/
• Official Microsoft pentesting rules of engagement: https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement
• Official Google pentesting policies: https://cloud.google.com/terms/aup
• MITRE’s CVE database:
  • https://cve.mitre.org/cve/
  • https://www.cve.org/
• A full list of bug bounty programs through HackerOne: https://hackerone.com/bug-bounty-programs
• NIST’s CVSS system: https://nvd.nist.gov/vuln-metrics/cvss
• FIRST’s EPSS system: https://www.first.org/epss/