CLOUD SECURITY TESTING: Examine what your cloud permissions make possible.
Cloud security testing examines how identities, configuration and service connections affect access to your cloud resources. We review the environment and investigate plausible routes from an exposed service or over-permissioned identity to sensitive data and workloads, so corrective work addresses the access those conditions make possible.
- Discipline
- Cyber Defense
- Engagement type
- Assessment
Individual settings can create a wider route.
A workload identity, shared role or exposed service may look acceptable in isolation. Its significance changes when it can reach another account, retrieve sensitive data or alter an important resource. Cloud assessment needs to consider those relationships alongside the configuration of individual services.
Common triggers
rapid cloud growth; changes to identity federation; a migration or new account structure; sensitive workloads moving into managed services.
Follow identities, exposure and control.
Human and workload access
Roles, service identities, permissions and relevant trust relationships.
Storage and managed services
Access to sensitive resources and the configuration controlling their exposure.
Network boundaries
Reachability between workloads, services and the internet.
Secrets and automation
How credentials and deployment processes influence access to the environment.
Logging and investigation context
Whether relevant activity is available to the teams that need to understand it.
Agree where review ends and active testing begins.
Configuration review and controlled testing answer different questions. We define the accounts, services and access involved, then agree which observations require further validation. Findings identify the affected resources and permission relationships, their implications and the changes needed to address them. The work concerns your authorised environment and follows the provider's applicable assessment policies.
What you receive
A record of the accounts, resources and services assessed.
Resource-specific findings and relevant identity or trust relationships.
A correction plan that distinguishes permission, configuration and operational changes.
Doesn't the cloud provider handle security?
The provider protects parts of the underlying service. Your responsibilities vary by service and include how you configure resources, manage identities and use the platform. The assessment focuses on the responsibilities within your control.
Is this a cloud compliance certification?
No. It examines the agreed configuration and security behaviours. A separate assurance or compliance requirement needs its own criteria and scope.
Do we need to provide administrator access?
The required permissions depend on the assessment. We determine the access needed for the agreed review and identify any additional permissions required for specific validation.
Where has your cloud environment become harder to reason about?
Share your platform, account structure and the workloads or access paths causing concern.
Related services: Identity & Access Management and Network Architecture Review.