Microsoft Cloud Readiness Assessment

Today’s technology is rapidly adopting cloud technology to assist organisations in moving to a cloud-based or hybrid infrastructure to provide flexible, redundant and cost-effective computing on an enterprise level.

The main issues associated with this technology is its inherent availability and default configuration, which is often exploited by attackers as they can easily access and attack these services with little risk of identification. A compromised account could prove fatal for most organisations as attackers could access resources located in the cloud, and internal resources in hybrid environments.

Pentest People’s Microsoft (MS) Cloud Readiness Assessment package combines both our Microsoft (MS) Cloud Security Review and Microsoft (MS) Cloud Breach Assessment to provide the most comprehensive assessment that covers both perspectives — the attacker and the administrator.

Listen to one of our Cloud Testing experts
breakdown this Pentest People Service

For those hard of hearing we have a transcript at the bottom of this page

Overview of Methodology

Cloud infrastructures vary in size, complexity, technologies, and in approaches to configuration, so Pentest People’s exact technical approach to each infrastructure may be very different. However, there are certain fundamental areas that are examined, which are as follows:

Open-Source Intelligence (OSINT)

The Microsoft Cloud Security Review has a strong focus on publicly available information that could be leveraged in targeted attacks. Information such as links to cloud resources, document metadata, email addresses, and leaked credentials, are gathered to identify common and applicable attacks from unauthenticated attackers.

Azure Configuration Review

The configuration of the Azure environment(s) are systematically investigated to establish a secure baseline that conforms with best practices. This assessment will cover all entities based in your environment(s) to highlight misconfigurations and bad practices. Pentest People understand that there are requirements and external factors that need to be satisfied — the consultant will take these into consideration when completing the post assessment report.

Office 365 Configuration Review

Office 365 and all connected apps, both first and third-party are reviewed to identify various issues. This can include (but not limited to) app misconfigurations, weak security configurations and ‘low hanging fruit’ issues that could be utilised by an attacker to escalate their access or access sensitive information.

Azure and Office 365 Security Assessment

The Office 365 and Azure instances are thoroughly tested using one or more domain user accounts to find exploitable vulnerabilities, which could lead to (but not limited to) data infiltration and exfiltration, privilege escalation and entity creation. This assessment aims to demonstrate what could happen if a domain user was compromised.

What Are The Risks?

Due to the rapid adoption of Microsoft’s cloud services, many companies that have embraced this technology are facing new and old cyber risks that can lead to the compromise of customer-owned cloud platforms, and on-premise infrastructures with hybrid cloud setups. All of which can have devastating consequences to any organisation.

How Can Our Microsoft Cloud Readiness Assessment Help?

The Microsoft Readiness Assessment provides the most comprehensive Assessment that covers the perspective of the administrator and the attacker.

Our Microsoft cloud trained consultants can assist in identifying vulnerabilities caused by, misconfigurations, bad practices and systems that are vulnerable to Azure-based vulnerabilities.

As well as practical exploitation of a compromised account to highlight poor configurations, controls and password usage.

These services allow you to remediate any security vulnerabilities before attackers can exploit them.

Find out more

With our Microsoft Cloud Readiness Assessment, you gain access to SecurePortal

Digital Report

Until now, the traditional deliverable from a Penetration Test engagement has been a lengthy 100+ page PDF report.

Pentest People have developed a solution to this issue where you interact with your vulnerabilities within the SecurePortal.

Stay Ahead

With the move to Cloud being a relatively new aspect within businesses its of great importance to make sure you’re set up correctly.

Stay ahead of emerging threats against Cloud Infrastructures by ensuring your platform follows best practices

Skilled Consultants

Rest assured that your assessments are performed by qualified Security Consultants.

Our specialised team of security consultants hold industry qualifications such as CHECK Team Member & Team Leader, CCIE, CISSP and CEH.

Mobile Application Testing Overview Transcript

Our team of highly skilled mobile application penetration testers can assess either your iOS or Android application for vulnerabilities. This is done by assessing both the client and the API that will be tested.

Our methodology includes but is not limited to reverse engineering, the application, exploiting services, broadcast receivers and other components, file checks. So looking at the database, looking at encryption, and attempting to communicate with the application from other apps on the device, the API will also be tested and we can also potentially bypass routes or jailbreak detection, or SSL pinning as part of our testing.

We will also look at the local runtime storage and look for any sensitive data that’s being leaked in the memory or in your logs.

Key Benefits

Understand the security issues you face within a cloud network through a very thorough assessment from a qualified security consultant.

Assurance that your cloud infrastructures and services are secure enough to withstand cloud-based attacks
Ensuring sufficient logging and controls are in place to mitigate these attacks.
Comply with various regulatory bodies who mandate regular Penetration Testing be performed within your infrastructure
Be able to focus efforts on important security issues by identifying the high-risk items identified in the Penetration Testing report