Using a cloud provider has some differences from on-premise systems, but it is still essential to conduct relevant vulnerability scans. Vulnerability scanning will help to proactively find cybersecurity issues and meet compliance requirements, such as for ISO 27001 and SOC 2.
- Review your cloud architecture
Some applications are as simple as a single cloud VM, while others may be complicated systems built on dozens of cloud services from multiple providers.
- Pick your vulnerability scans
You will most likely need multiple types of vulnerability scanners to test your entire attack surface area. For example:
- Network vulnerability scanner
- Web application vulnerability scanner (DAST)
- Source code and dependency scanner (SAST)
- Container image scanner
- Check your cloud provider's penetration testing policies
Most cloud providers allow vulnerability scanning and penetration testing of resources that are specific to your customer account, but do not allow testing of multitenant service endpoints. Denial of Service (DOS) testing is generally not allowed without prior authorization.
For example:
- Run your scans!