Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

AWS versus Azure Cloud Testing: Understanding the Differences

netspi.com | blog | #cloud | #cloud-security | #aws | #azure | #shared-responsibility | #cloud-pentesting

Summary

Compares cloud penetration testing across AWS and Azure, explaining the shared responsibility model and why platform-specific nuances matter for methodology and cloud security maturity.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Overcome Cloud Security Challenges with Purpose-Built Cloud Penetration Testing
Outlines five cloud security challenges—shadow IT, attacker-defender resource asymmetry, catastrophic misconfigurations—and argues purpose-built cloud penetration testing is the way to address them.
blog · netspi.com
Your Cloud Assets are Probably Not as Secure as You Think They Are
Gartner attributes up to 95% of cloud breaches to human configuration errors; NetSPI catalogs usual suspects like missing MFA, cloud-on-prem integration, and over-permissioned accounts.
blog · netspi.com
Get-AzurePasswords: Exporting Azure RunAs Certificates for Persistence
Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.
blog · netspi.com
Running PowerShell on Azure VMs at Scale
Karl Fosaaen shows how Azure Contributor rights enable VM command execution as SYSTEM via Invoke-AzureRmVMRunCommand without opening firewall ports, scaling PowerShell across subscription VMs.
blog · netspi.com
Anonymously Enumerating Azure Services
Karl Fosaaen releases a script for anonymous Azure service enumeration, brute forcing DNS across azurewebsites.net, cloudapp.net, and blob.core.windows.net to map a target's public Azure footprint.
blog · netspi.com
Get-AzurePasswords: A Tool for Dumping Credentials from Azure Subscriptions
Karl Fosaaen introduces Get-AzurePasswords, a MicroBurst script that automates credential dumping from Azure Key Vaults, App Services configurations, and Automation Accounts via Azure PowerShell.
back