Summary

The reason why we conduct pentesting is to learn about security vulnerabilities in computer systems by simulating cyberattacks.

There are possibly hundreds or thousands of potential cyberattack vectors in a cloud network, both internal and external. Users, user accounts, machine identities, and vulnerabilities in internet-facing applications are just some of the many possibilities.

You may not be able to simulate all of the possible types of exploits. For instance, cloud providers often prohibit simulating DDoS attacks, and you also won’t be allowed to physically visit the cloud provider’s data centers to plant test devices. But it’s important to understand all the different things an attacker could do and keep them in mind when you’re conducting your red team engagements.

Attacks can originate internally or externally from your organization. The CIA Triad of cybersecurity is a concept to explain how cyberattacks can impact your organization...