Knowing the attacker

Say you are on a pentesting assignment, and your client asks you to test their systems. There are a couple of ways we can do this. We can do it from an outsider perspective, or from an insider perspective. Both offer the client a different return of results and return on investment based on the client's business needs. Let's take a quick look at what exactly an insider and an outsider are.

Insiders

The more common request will be from an insider perspective. Insiders are considered employees or someone with access to the client's systems. This means you, the tester, would be given the information needed to connect to the AWS environment. You'll be given an account ID and credentials to access the cloud environment, and from there can let your scripts run to find issues in S3.

Often, white-box pentesting will be combined with an insider perspective. What that translates into is the client needs the pentesting firm to check for anything...