Cloud Penetration Testing simplified

What is a Penetration Test?
It is a security testing methodology that gives us an insight into the strength of the Cloud network security by simulating an attack from unknown malicious source. It involves an active analysis of the cloud service for potential vulnerabilities due to incorrect system configuration, hardware / software flaws, or operating system level weaknesses. This analysis is carried out from the perspective of a potential hacker and can involve active exploitation of security vulnerabilities. The intent of this test is to proactively determine the feasibility of a hack attack and also try to determine the extent of damage to the business.

Why is Penetration Testing needed on the Cloud?
Cloud Penetration Testing has become a necessity today. The evolution of the cloud technology has focused on the ease of use from an operational perspective with an exponential increase in the complexity of the computing resources! Also, skills needed to hack into systems have steadily decreased with so much knowledge available online. Add to that, the number of network and cloud based applications have increased many fold. And lastly, a security breach on enterprise assets can be a huge detrimental issue to the goodwill and the image of an enterprise!

How is Penetration Testing carried out?
It is usually carried out within a "Black Box" - without any knowledge of the infrastructure to be tested. At a basic level, there are 3 phases in a Penetration Test.

1. Preparation - This is the planning phase where formal non-disclosure agreements are signed and ensures legal protection for both the tester and the client. It should list the IP addresses to be tested along with the timeline at a minimum.
2. Execution - The test is executed and potential vulnerabilities are exposed. The test should address vulnerabilities, risks to applications, remote access systems, VoIP, wireless networks
3. Delivery - Results of the test are communicated to the client and corrective action is advised.

What are the Tools & Techniques for Penetration Testing?
There are a variety of tools & techniques that can be used to conduct Penetration Testing on Cloud Systems. Tools like Whois, Nslookup, Traceroute, VisualRoute, SmartWhois, SamSpade can help gather information about the target network.

• Whois gets you the domain's registrant, administrative & technical contacts, addresses, phone numbers & domain servers.  
• Nslookup gets you the Internet domain servers, information about DNS infrastructure, MX records, IP of the mail servers etc. 
• Traceroute exploits the Time To Live (TTL) feature of the Internet Protocol and gets you the path the IP packets traverse between two systems by sending out consecutive User Datagram Protocol (UDP) packets with ever increasing TTL's. This utility reveals the DNS names, network affiliations & geographic locations.
• VisualRoute from VisualWare gets you traceroute, ping tests, DNS & Whois lookups and displays the actual route of connections and IP address locations visually on a global map.
• SmartWhois gives you comprehensive information regarding the IP address, hostnames, domain names, country, state, city, network provider, contact information etc.
• Sam Spade is a freeware tool to track down spammers and comes with many useful network tools including ping, Nslookup, Whois, IP block Whois, traceroute, finger, SMTP, VRFY, SMTP relay check etc. 

Other tools include utilities like Port Scanners, Vulnerability Scanners & Password Crackers. More to come later...

References: Cloud Security - Ronald L.Krutz & Russell Dean Vines
Also posted on BMC Communities blog - Cloud-n-more

Cloud Forensics & Obstacles

What is Cloud Forensics?
Cloud Computing usage is increasing day by day and so is criminal activity as cyber criminals figure out ways to monetize unauthorized access to IT solutions in the cloud environments. Cloud Forensics is like any other forensic investigation where experts try to gather evidence of a cyber-crime in a cloud environment and try to persecute the criminal. Computer forensics attempts to ensure the authenticity of data, but cloud computing environments pose significant obstacles to this process since the hardware, software, infrastructure does not usually belong to the organization that has been attacked / compromised or breached.

Significant Obstacles
When I say significant obstacles, I refer to the architecture of the Cloud Computing, Cloud Services & Delivery Models. With multi-tenant hosting, globalization of the servers and data centers, different jurisdictions in different countries, lack of standards, lack of access to network routers, firewall & other hardware it becomes very difficult to obtain evidence of attacks, breaches & cyber-crime

So how to overcome these obstacles?
There is no easy way to overcome these obstacles! Very few tools are available that continuously record everything in the cloud environment. a few tools that do record these events produce huge logs that are humanly impossible to sift through. What is needed is a compact log file that can be read and understood by even the common man to understand and back-track the events that led to the cyber-crime! It's not very far when we get to that technological nirvana!

Also posted on BMC Communities blog - Cloud-n-More