Kaspersky’s security research team has unveiled a detailed new framework designed for penetration testing specifically tailored to cloud platforms. This essential initiative highlights notable deficiencies in existing assessment methodologies that security professionals rely upon. The traditional approaches often prioritize testing only the management console, customer-facing interfaces, and APIs. However, this surface-level examination largely neglects the intricate internal architecture crucial for maintaining separation amongst tenants and safeguarding the provider’s infrastructure. As the researchers point out, such a limited focus fails to adequately address vital questions about potential risks—including whether an attacker could read or manipulate data belonging to other customers, compromise service accounts managed by the provider, or even escape from virtualized environments.
The development of this comprehensive methodology has been a significant endeavor, taking place over several years and through multiple cloud security projects. Kaspersky proposes a multi-layered model for viewing cloud infrastructure, consisting of three distinct layers: the External layer, which encompasses customer-facing interfaces; the Overlay layer, representing the provider’s internal service management systems; and the Underlay layer, which includes the physical and virtualization infrastructure. To illustrate these layers effectively, the researchers employ a hotel analogy: the External layer is akin to the booking website and guest rooms, the Overlay layer corresponds to staff-only areas equipped with master keys, and the Underlay layer reflects the technical utility systems that sustain operations beneath the surface. This tri-layered framework is instrumental in aiding security teams in systematically identifying trust boundaries that require rigorous testing rather than unfounded assumptions of safety.
Moreover, the methodology emphasizes that simply finding vulnerabilities or achieving code execution within a segregated tenant environment should be seen as only the initial step in conducting a meaningful security assessment. The true value lies in discerning whether an attacker has the ability to breach trust boundaries between isolated environments. The researchers delineate five critical questions that must be answered during assessments: Can attackers gain access to data belonging to other tenants? Is it possible to compromise provider service accounts? Does a breach in one runtime environment facilitate lateral movement across other segments? Can low-trust segments impact resources controlled by the provider? Lastly, is there a possibility for virtual environment escape? Interestingly, the team notes that even negative results, or findings that no vulnerabilities exist, yield valuable information, as they can confirm which protection boundaries are functioning as intended and which are reliant on untested assumptions.
The inherent complexity of cloud platforms poses unique challenges for conducting assessments, primarily due to the absence of a unified technical standard in their construction. For instance, the same managed database service might be hosted in an isolated virtual machine at one provider while being executed within a shared Kubernetes cluster namespace at another. At yet another provider, it might reside in a dedicated tenant cluster. This variability necessitates that penetration testers reconstruct the internal architecture of systems based on indirect evidence, such as active running processes, network routes, certificates, and service configurations, often after breaching the initial tenant boundaries. The intricacy of this task goes well beyond standard port scanning and requires a comprehensive understanding of how different components interrelate across trust boundaries.
For organizations that depend on cloud services, it is imperative to ensure that their providers carry out thorough security assessments that extend beyond just evaluating external attack surfaces. Security teams should proactively request evidence demonstrating that penetration tests specifically focus on mechanisms for tenant isolation, the boundaries of service account privileges, and the efficacy of controls that separate customer workloads from management infrastructure operated by the provider. The research conducted by Kaspersky points out that proving the security of a cloud platform necessitates testing the actual enforcement of trust boundaries. This involves examining authentication, authorization, isolation, and cryptographic controls, as opposed to relying solely on architectural assumptions.
In summary, this innovative framework set forth by Kaspersky not only enhances the understanding of security challenges associated with cloud platforms but also delineates a strategic pathway for more effective assessments. The call for a multidimensional approach to penetration testing could significantly bolster cloud security practices, ensuring a more robust defense against increasingly sophisticated cyber threats.