Conducting penetration testing in cloud environments
One of the ways to raise our assurance with a cloud provider is to conduct a penetration test to measure the effectiveness of their security controls.
In the SaaS model, a penetration test allows us to measure how the SaaS provider protects our data. In the IaaS model, a penetration test allows us to measure the effectiveness of the security controls we have implemented. In IaaS environments, we are in charge of the OS layer and the network environment around the virtual machines or containers.
In PaaS environments, specifically in serverless (or Function as a Service (FaaS)), we are not in charge of the lower layer of the OS; however, since we import our code, we are in charge of making sure we follow a secure development life cycle.
In SaaS environments, we are only in charge of inserting data and controlling access to the service.
If we expose a service to the internet or use a SaaS service, we need to evaluate topics...
