Cloud security
The cloud account, tested.
Offsecure tests cloud infrastructure, the applications on it, and the data it holds. The work is built for AWS, Microsoft Azure, and Google Cloud, and for an estate that uses more than one of them.
Cloud security testing is an assessment of the account as it is configured, and of the paths an attacker would take through it. Misconfiguration is a common cause of cloud breaches, and the test treats it as one.
What the work covers
One provider or several, including a hybrid estate. The same standard is applied across them.
- Cloud penetration testing. A simulated attack against the cloud environment, with remediation for what it reaches.
- Configuration review. Permissions, storage, and access control, checked from the foundation up.
- Identity and access. An audit of IAM policy and configuration, including the paths that would let a privilege escalate.
- Compliance. Cloud audits against GDPR, HIPAA, and PCI DSS, where the deployment is held to those standards.
- More than one cloud. AWS, Azure, Google Cloud, or a hybrid of them, assessed to one standard rather than three unrelated ones.
How it is done
The providers
The team works in AWS, Microsoft Azure, Google Cloud, and the other providers an estate may include.
The whole account
Penetration tests and configuration reviews, scoped to the environment that is actually in use.
A recommendation
Each finding comes with a specific change. The point of the test is the fix, not the inventory.
Ahead of the next one
The assessment is written so the same class of risk is visible before it becomes an incident.
