Security responsibilities in the cloud
As a cloud pentester, it’s important for you to understand how the shared responsibility model works in the cloud. The two entities involved are the organization that’s using cloud services, and the cloud provider. When you conduct red team engagements, the organization is the entity you report to, whether you’re an employee or a third-party contractor.
Overall, the organization and the cloud provider have shared security responsibilities. This is often called the shared responsibility model. However, cloud security controls and responsibilities are divided between the two entities.
It’s important for you to understand what the cloud provider is responsible for and what the organization you’re working for is responsible for. At the beginning of each pentest or red team engagement, you will sign a contract that outlines the scope of the pentests and what you’re allowed and not allowed to do. You absolutely...
