Cloud Security Risk Assessment (AWS, inc. design review and pentesting)

Assessing the security of your AWS environment is essential to understanding the risks facing your cloud infrastructure and platform services hosting valuable business applications and data. Our Cloud Security Risk Assessments (CSRA) involve a comprehensive process to assist in mitigating threats facing your organization.

Forward’s team of AWS experts conduct a security risk assessment including pentesting of your current environment following the process below:

• a) Discovery: understanding the security design of your AWS environment is essential to ensuring potential threats are identified during the assessment process. Our security consultants will work closely with your team to get an understanding of the AWS environment to inform our approach and identify security gaps. The security aspects of the AWS Well Architected framework are used as a basis for this design review, in addition to in-depth analysis of networking, IAM, logging & monitoring, as well as cryptographic controls. This can include hands-on design workshops and whiteboard sessions with team members.
• b) Threat modelling: based on the discovery output, threat modelling will be conducted to identify key threat scenarios specific to your application. We use the STRIDE scheme to classify threat scenarios and an enhanced DREAD model to assign the specific impact and likelihood levels to determine the risk for each identified issue, which will be reviewed with your team.
• c) Pentesting: Using CIS’s AWS Foundations Benchmark as a starting point for a set of assurance criteria, our team will build and execute test cases using manual and automated methods to verify each threat scenario and identify the actual risks to your business.

Upon completion, comprehensive reports are provided that include details of how each attack can be conducted, recommended controls, and the risk for each threat scenario to assist in remediation efforts addressing the issues that matter most aligned with your business context and AWS environment.