So, let's say as an organization,
you are performing an audit, or an audit is being performed on you,
maybe it's an internal audit, and it's not the audit that we talked
about from the major providers. We have to know that depending on the
depth and purpose of the audit,
there may be a need to prove out the effectiveness of control by
means of some type of testing. Audit scope restrictions will make
it so that we have acceptable and unacceptable testing periods, and
we have to make sure that the environment is protected from
destructive practices.
We also need to ensure that there's reduced impact upon
operational or live environments.
Some cloud service providers do not allow certain types of testing.
Things like denial‑of‑service are not allowed by a number of platforms.
So it's up to us to ensure that we understand what
the cloud service provider allows.
Amazon, for instance,
has a set of services that it says are permitted when it comes
to penetration testing, on systems like EC2 instances, Elastic
load balancers and CloudFront,
but it doesn't allow things like zone walking or port
flooding and other DDoS activities.
So it's important for us to be able to understand that. All other
testing requires preauthorization and permission. In the introduction to
testing rules of engagement, not only does Azure say that you must
follow all the rules stated in the policy,
but any damage your testing causes to Microsoft or any customers
makes you responsible, and penalties include suspension or
termination of service for any violation.
So they have things that are in scope and things that are actually prohibited.
For instance,
they have rules against generating large amounts of
traffic. Google, on the other hand,
as you review the top three providers and you get into their
penetration testing policies, they have always allowed
penetration testing on your own project,
and they have the most scaled‑down policy statement of the top three providers.
It's literally in this paragraph that you see here. The reason why is a
completely different story for a different period of time.
If you look up BeyondCorp,
you will find the answer as to why they're so open about being able to
test and why they actually don't express prohibitions,
besides not taking illegal actions against another customer or Google.