Cloud Security

AWS Fit-for-Purpose Security Configuration Baseline

An AWS Security Configuration Baseline reviews the implementation of an AWS environment, looking to identify any areas that could present risk or unintentional access to the internet. The baseline assessment considers the organisational requirements and context for cloud services and compares this against best practice implementation guidelines and hardening standards.

Security Control Effectiveness

The following AWS functions, services and areas, where applicable, are assessed against the guiding principles for security control effectiveness:

Audit Function Effectiveness

The following AWS functions, services and areas are to be assessed against the guiding principles for audit function effectiveness:

Network Segmentation Testing

Testing can be performed within each network segment to validate segmentation effectiveness.

The ability to access assets where there is no business or technical justification shall be identified, as well as ability to exfiltrate data through side channels.

Azure

An Azure Security Configuration Baseline reviews the implementation of an Azure environment, looking to identify any areas that could present risk or unintentional access to the internet. The baseline assessment considers the organisational requirements and context for cloud services and compares this against best practice implementation guidelines and hardening standards.

Security Control Effectiveness

The following Azure functions, services and areas, where applicable, are assessed against the guiding principles for security control effectiveness:

Network Segmentation Testing

Testing can be performed within each network segment to validate segmentation effectiveness.

The ability to access assets where there is no business or technical justification shall be identified, as well as ability to exfiltrate data through side channels.

Office 365

Microsoft Office 365 includes many advanced security features, however many of these are either disabled or in an overly permissive state by default.

An Office 365 Security Configuration Baseline reviews the implementation of a tenancy, looking to identify any areas that could present risk or unintentional access to the internet. The baseline assessment considers the organisational requirements and context for cloud services and compares this against best practice implementation guidelines and hardening standards.

An office 365 Best Practices Security Configuration Assessment will assess the following areas: