Chapter 1, How Do Enterprises Utilize and Implement Cloud Networks?, introduces AWS, Azure, and GCP, the difference between hybrid cloud, all-cloud, and multi-cloud networks, software-as-a-service, platform-as-a-service, and infrastructure-as-a-service, and the shared cybersecurity responsibilities between organizations and their cloud providers. Before you start pentesting in AWS, Azure, and GCP, it’s important to understand why and how enterprises use those cloud platforms.
Chapter 2, How Are Cloud Networks Cyber Attacked?, examines how cloud networks are susceptible to a wide range of cyberattacks. This chapter explains the various types of cyber attacks, both external and internal, and attacks that impact the confidentiality, integrity, and availability of computer data, based on the CIA Triad cybersecurity model. You will test the security of cloud networks, based on simulating some of the actions of cyber threat actors.
Chapter 3, Key Concepts for Pentesting Today’s Cloud Networks, covers the core concepts and procedures that are applicable to all cloud pentests. Before a pentest or red team engagement is conducted, security professionals must understand the state and scope of their pentest target. You should conduct a vulnerability assessment to find exposed services and integrations, and once a pentest is done, you need to share your findings effectively so that your client’s security posture can be improved accordingly.
Chapter 4, Security Features in AWS, explores the plethora of features, applications, and tools that are specific to AWS and their implications for pentesters. This chapter also covers AWS’s own security policies and security tools.
Chapter 5, Pentesting AWS Features through Serverless Applications and Tools, discusses the most relevant and effective security features and tools to conduct the most successful AWS pentest possible. There are a number of security controls, security features, and pentesting tools that are specific to AWS, both first-party and third-party.
Chapter 6, Pentesting Containerized Applications in AWS, dives into the specific technicalities of how Docker and Kubernetes are deployed and managed in AWS. Enterprises are increasingly deploying containerized applications within AWS to fully leverage the scalability of containerization for virtualization. You will then learn pentesting techniques that are unique to how those containerization platforms run in AWS.
Chapter 7, Security Features in Azure, explores the plethora of features, applications, and tools that are specific to Azure and their implications for pentesters. The chapter also covers Azure’s own security policies and security tools.
Chapter 8, Pentesting Azure Features through Serverless Applications and Tools, examines the most relevant and effective security features and tools to conduct the most successful Azure pentest possible. There are a number of security controls, security features, and pentesting tools that are specific to Azure, both first-party and third-party.
Chapter 9, Pentesting Containerized Applications in Azure, covers the specific technicalities of how Docker and Kubernetes are deployed and managed in Azure. Enterprises are increasingly deploying containerized applications within Azure to fully leverage the scalability of containerization for virtualization. You’ll also learn pentesting techniques that are unique to how those containerization platforms run in Azure.
Chapter 10, Security Features in GCP, dives into the plethora of features, applications, and tools that are specific to GCP and their implications for pentesters. This chapter also covers GCP’s own security policies and security tools.
Chapter 11, Pentesting GCP Features through Serverless Applications and Tools, examines the most relevant and effective security features and tools to conduct the most successful GCP pentest possible. There are a number of security controls, security features, and pentesting tools that are specific to GCP, both first-party and third-party.
Chapter 12, Pentesting Containerized Applications in GCP, covers the specific technicalities of how Docker and Kubernetes are deployed and managed in GCP. Enterprises are increasingly deploying containerized applications within GCP to fully leverage the scalability of containerization for virtualization. You’ll also learn pentesting techniques that are unique to how those containerization platforms run in GCP.
Chapter 13, Best Practices and Summary, reviews what you’ve learned after performing pentesting exercises in AWS, Azure, and GCP. This chapter also explains the work that you need to do before and after your pentests and red team engagements. Most importantly, you’ll need to define a scope for your engagements with the organization that you work for that abides by AWS, Azure, and GCP’s policies, sign legal documents that formalize your scope and responsibilities, and write a pentest report that will help the business leaders and defensive security team in your organization improve their network’s cybersecurity.
