Updates on RSA 2018, GDPR, and Cloud Security: Shieldcast - Spring 2018

Deployment Model

Firewalls and intrusion detection systems must be in place to secure cloud environment.

Techniques: Server Hardening, Firewall, Router, DNS, and Mail Server Testing

Data Security

As in cloud model, enterprise data is stored outside its boundary, verify security checks like data encryption and authorization to control data access.

Techniques: XSS, Access Control Weakness, OS/SQL Injection Flaws, CSRF, Cookie Manipulation, Hidden Field Manipulation, Insecure Storage, and Insecure Configuration

Network Security

Verify network for security against MITM attacks, IP Spoofing, Port Scanning, Packet Sniffing etc. Network traffic must be encrypted using techniques such as SSL/TLS.

Techniques: Network Penetration and Insecure SSL trust configuration

Regulatory Compliance

Confirm adherence to regulatory and industry standards such as ISO, SOX, HIPAA, PCI etc.

Data Privacy

As on cloud data stores are shared across multiple enterprises, so tests to ensure that data of an application is not accessible to other applications are must to execute.

Techniques: Encrypted data stores

Disaster Recovery and Availability

In case of attack, check if the application is still available to customers. Multi-tier architecture, load balancing approach, business continuity, and disaster recovery techniques need to be verified.

Techniques: DOS Attacks

Identity Management [IdM] and Sign-on Process

Verify the security of IdM model of cloud vendor.

Techniques: Session management weaknesses and Authentication weakness