Azure Penetration Testing Methodology

RedTeam Security的Azure Penetration Testing Methodology

Testing in Azure follows RedTeam Security's standard network or web application penetration testing methodology, 并对Azure环境架构进行了一些具体的修改. RedTeam Security uses PTES as the framework for our comprehensive network penetration testing methodology, and our web application penetration testing focuses on identifying OWASP's Top 10 vulnerabilities.

We utilize many of the same techniques employed for standard penetration testing engagements while also checking for Azure-specific misconfigurations and vulnerabilities during Azure penetration testing engagements. 这些检查可能包括对公共可访问存储帐户的测试, 作用域不恰当的Azure基于角色的访问控制(rbac), weak password policies, guest access, and seeking to penetrate on-premises Windows Active Directory systems synced to the cloud using Azure AD Connect.

RedTeam Security's cloud pen testing includes three different attack vectors within the Azure platform:

• 测试可能导致云环境损害的应用程序缺陷.
• 直接测试云网络, whether the servers are set up as exclusively internal only or are hosting externally facing services exposed to the Internet.
• Azure门户中错误配置的认证测试.

RedTeam Security's penetration testing methodology assesses the cloud security of your environment using a multi-layered approach: Information Gathering, Threat Modeling, Vulnerability Analysis, Exploitation, and Reporting.

在开始评估您的云环境之前，首先要进入预参与阶段. During the pre-engagement phase, RedTeam will collect the details needed to begin the project. 在此步骤中收集的数据元素包括测试窗口, testing dates, IP addresses, 以及其他相关信息. This phase is crucial as it establishes the general rules of engagement for your Azure pen testing engagement.

RedTeam将与您密切合作，确认启动会议所需的细节. 这项重要的工作确保了云笔测试的高效执行, effectively, 根据总体目标.

Information Gathering

除了在典型的室内冰球突破豪华版试玩中收集的数据之外, 冰球突破豪华版试玩汇编所需的其他信息 Microsoft Azure pen testing , 包括列举公共可访问的服务和资源, and enumerating principles, roles, 和资源连接到Azure帐户.

Azure Threat Modeling

威胁建模是一个多步骤的过程. Initial threat modeling will be done through discussions with you to identify your most important assets to protect. 对于一些公司，这可能是财务数据，知识产权，或捐赠信托.

Then, 因为附加信息是通过信息收集来收集的, 威胁模型是不断完善的. This begins with using various security tools to perform automated scans and is followed by using manual testing techniques to dig deeper, uncover, 并验证潜在的漏洞. 在威胁建模步骤中，将对资产进行标识并将其分类到威胁类别中. 这些类别可能包括敏感文件, trade secrets, or financial information but more commonly consist of technical information found during the previous phase.

Azure脆弱性评估

RedTeam Security will leverage additional automated tools to identify vulnerabilities in the environment, 无论是网络还是web应用程序, 以及任何关于原理的列举信息, roles, subscriptions, resource groups, 和Azure环境中的资源，并确定安全问题. RedTeam Security will also analyze the account's security by checking the status of configurations like multi-factor authentication and guest access. We will develop attack chains during this phase based on our initial findings regarding Azure roles and resources. The aim will be to create opportunities to exploit vulnerabilities that allow for privilege escalation, resource misuse, 或数据外泄以实现业务的目标.

Azure漏洞剥削

不像脆弱性评估, 冰球突破豪华版试玩寻求对漏洞采取行动以实现利用. Exploitation involves establishing access to systems by bypassing security controls to determine the real-world effectiveness of your defenses and your actual level of risk. 在RedTeam安全云平台冰球突破豪华版试玩期间, 这个阶段包括协调的手工测试策略，并且通常是时间密集的.

• 在云上测试应用程序 - Testing for applications in Azure begins exactly as it would for a penetration test of an on-premises system and will include testing for f the same OWASP Top 10 vulnerabilities. During testing, RedTeam Security will attempt to gain access to storage accounts and view their contents while recommending practices that will help your organization develop a roadmap toward implementing best practices in storage security. We will also review the security and efficacy of managed and custom policies employed via Azure Web Application Firewall on Azure Application Gateway.
• Testing Networks in the Cloud —对云中的网络资产进行测试时, 在Azure中进行内部网络测试, RedTeam Security will often use a VPN or Virtual Machine to gain access and begin scanning the network for vulnerabilities. RedTeam Security will attempt to gain credentials or access to the internal servers or devices. 用于外部网络冰球突破豪华版试玩, RedTeam Security将评估Azure防火墙等网络技术的安全性, Azure VPN Gateway, 以及其他能够提供访问公司网络的桥接技术. RedTeam Security will attempt to gain access to internal networks by enumerating firewall rules, looking for weak passwords, 揭示了虚拟机配置中的弱点.
• Testing the Azure Portal - RedTeam Security will analyze the security configurations in the Azure Portal using a client-provided test-user. Red Team will also assess the security of Azure Role-Based Access Controls in use and other Azure services, such as Azure Key Vault, Azure App Service, and Azure Automation.

Azure Reporting

At RedTeam Security, 冰球突破豪华版试玩认为这一阶段是最重要的, and we take great care to ensure we've communicated the value of our service and findings thoroughly. Our comprehensive Azure pen testing services will help you ensure that your cloud infrastructure is designed and configured according to best practices. The report will provide an analysis of the current state of your Azure environment and help you prioritize which vulnerabilities to address first and how best to use your budget to maximize strength and resilience in your security posture.

补救的免费重新测试

如果标识了要进行补救的项, 一旦这些补救措施完成，请让冰球突破豪华版试玩知道, 冰球突破豪华版试玩会安排对这些补救措施进行重新测试. 一旦重测完成，冰球突破豪华版试玩会发布更新后的报告.