Cloud Infrastructure Assessment
Security professionals are facing the difficult challenge of extending security requirements to take advantage of cloud computing and software-as-a-service applications. This stems from the fact that as per the very definition of Cloud Computing, the infrastructure visibility to the end customer is very low especially in SAAS & PAAS Models. Furthermore, there could be several issues in the underlying OS and network designing/configuration which can compromise your sensitive data residing on the cloud.
For example, a denial of service attack launched by a malicious insider was demonstrated against a well-known IaaS cloud. The attack involved a cloud subscriber creating an initial 20 accounts and launching virtual machine instances for each, then using those accounts to create an additional 20 accounts and machine instances in an iterative fashion, exponentially growing and consuming resources beyond set limits.
- Marco Slaviero, BlackHat Presentation Demo Vids: Amazon, part 4 of 5, AMIBomb, August 8, 2009, http://www.sensepost.com/blog/3797.html.
- Kim Zetter, Bank Sends Sensitive E-mail to Wrong Gmail Address, Sues Google, Wired Magazine, September 21, 2009, URL: http://www.wired.com/threatlevel/2009/09/bank-sues-google.
Our well experienced and qualified team of experts assess the network design, virtualization topology (if any), Intrusion detection checks, failover controls, etc as per your business requirements.
Using globally recommended frameworks from NIST, ENISA, CCM, etc, VISTA InfoSec has developed a state-of-the-art assessment framework which effectively helps identify and mitigate infrastructure based risks on the cloud such as:
- Insider Access
- Ancillary data
- Software isolation
- Availability