Cloud penetration testing is designed to assess the strengths and weaknesses of the cloud environment/system to improve overall security postures. Cloud penetration testing is an attack simulation performed to find vulnerabilities that can be exploited or to find any misconfigurations in a cloud-based system.

Before moving to practice cloud security or cloud penetration testing, one has to learn the basics of Cloud Computing like what is cloud/cloud computing, types of cloud, service models, cloud service providers, advantages and disadvantages, etc.

So, a cloud-based testing or cloud penetration testing is an approach that uses cloud-based tools to emulate real-world user traffic and environments for testing any type of application, network and infrastructure. Cloud security vulnerabilities involve insecure api’s, supply chain attack, data exfiltration, mitm attack, misconfigured instances, misconfigured cloud storages, poor access management and privileged account access etc.

OWASP Top10 Cloud Security Risks :

• R1. Accountability & Data Risk

• R2. User Identity Federation

• R3. Legal & Regulatory Compliance 

• R4. Business Continuity & Resiliency 

• R5. User Privacy & Secondary Usage of Data 

• R6. Service & Data Integration 

• R7. Multi-tenancy & Physical Security 

• R8. Incidence Analysis & Forensics 

• R9. Infrastructure Security 

• R10. Non-production Environment Exposure