A cloud security assessment is an evaluation that tests and analyses an organisation’s cloud infrastructure to ensure the organisation is protected from a variety of security risks and threats. The assessment is designed to:

• ⇉ Identify weaknesses and potential points of entry within the organisation’s cloud infrastructure. 

• Analyse the network for evidence of exploitation. 

• ⇉ Outline approaches to prevent future attacks. 

A cloud security assessment typically focuses on the following seven areas: 

1. 1. Overall security posture: Conduct interviews and a documentation review to evaluate the security of enterprise cloud infrastructure. 

1. 2. Access control and management: Review identity and access management, including user accounts, roles, and key management. 

1. 3. Network security: Review segmentation and firewall policies against common misconfigurations. 

1. 4. Incident management: review incident response policies related to cloud infrastructure, including roles and processes related to an incident. 5. Storage security: Assess the posture of cloud storage, including object-level storage, block-level storage, and related snapshots. 

1. 6. Platform services security: Review the security configuration of advanced service offerings specific to each cloud service provider. 

1. 7. Workload security: Review security for workloads including virtualized servers, server-hosted containers, functions, and serverless containerized workloads.

WHY DO YOU NEED A CLOUD SECURITY ASSESSMENT? CSA 

Cloud computing offers organisations significant operational efficiencies as compared to traditional on-premise servers. However, innovation and reliance on the cloud also introduce new risks. The rapid adoption of cloud-based workloads often outpaces an organisation’s security services capabilities, leaving technology leadership with a serious blind spot. Organisations often have multiple cloud accounts or subscriptions that do not all receive the same level of security oversight, leading to situations in which less “important” workloads lack critical security controls. The impact of a breach can be surprisingly serious, even in cloud environments that were previously considered less important.

Unlike a traditional network, which is often defended through a perimeter security model, the cloud environment requires more advanced security measures that provide “anytime, anywhere” protection. Further, as more users access cloud-based systems due to work-from-home requirements, the organisation’s attack surface can inadvertently expand, increasing risk.

One common issue related to cloud security is misconfiguration. The root cause of many security breaches and cloud misconfigurations often stems from errors inadvertently made by network engineers when the technology was in its infancy. A cloud security assessment is a necessary step in identifying such issues as well as any other outdated aspects of the security model. 

Ineffective user account management such as excessive privileges, a lack of restrictions on source IP addresses or source countries, reliance on static credentials for users or workloads with which to authenticate to the cloud service provider, or lack of multi-factor authentication (MFA), which is a security practice that leverages two or more independent pieces of evidence to confirm the user’s identity, Taken together, these issues make it easier for adversaries to impersonate authorised activity and tamper with, exfiltrate, or destroy data. Finally, insufficient or improper logging, which is common in cloud-based systems, makes malicious activities more difficult to detect, characterise, and recover from, leading to higher costs.

WHAT ARE THE BENEFITS OF A CLOUD SECURITY ASSESSMENT? CSA 

A cloud security assessment offers organisations peace of mind that their network and assets are properly configured, adequately secured, and not the subject of an ongoing attack. In reviewing the organisation’s network history, the evaluation will also identify points of access or other weaknesses within the architecture, as well as detailed recommendations to help strengthen defences and improve capabilities in the future.

Specific benefits of a cloud security assessment include:

• ⇉ Reduced risk from accidental misconfiguration: By adopting the tailored configuration changes recommended as part of the cloud security assessment, the organisation can reduce its attack surface in the cloud environment. 

• ⇉ Reduced risk from missed notifications: The cloud security assessment team’s recommendations can improve an organisation’s ability to detect and respond to compromise so that a minor issue does not become a full-blown breach. 

• ⇉ Improved resilience: The team performing the cloud security assessment will provide recommendations to help organisations recover from a breach faster. 

• ⇉ More efficient account management: Organisations with less-than-optimal identity architectures can reduce their time spent on account and privilege management while reducing the chances of inadvertent excessive privileges being granted. 

• ⇉ Detection of past compromise: While a cloud security assessment is not a comprehensive cloud compromise assessment, it can identify variances from the norm in the organisation’s cloud configuration that could have been caused by compromise.

HOW IS A CLOUD SECURITY ASSESSMENT PERFORMED?

A Cloud Security Assessment usually consists of three basic components:

1. Documentation review and interviews help the assessment team understand the business purpose of the client’s environment, the intended architecture, and planned changes to the environment. 
2. Automated and manual testing: The assessment team runs specialised tools to collect information about the environment, identify misconfigurations and gaps vs. ideal architecture, and evaluate possible attack chains. 
3. Recommendation generation: The assessment team builds recommendations for each finding and presents them to the client’s security team. 
4. Presentation: The assessment team works with the client’s internal stakeholders to discuss findings and answer questions about both individual technical and high-level recommendations.

1. Additional cloud security services may include:

   • ⇉ Incident Response for Cloud: Incident response and forensic analysis of a breach of your cloud environment
   
   
   • ⇉ Compromise Assessment for Cloud: Determine if your cloud environment has been breached (past or current). 
   
   
   • ⇉ Red Team/Blue Team Exercise for Cloud: Simulate a targeted attack on your cloud environment to test your cyber defences.