Contact Us
Contact Us
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Subscribe to our newsletter
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Cloud Penetration Testing

Adoption of cloud services and/or technologies is no doubt indispensable in today's world. The question remains - Whether a cloud setup (any service model) provides safe and secure environment to their staff and customers?

Find out more
Get in touch for a FREE quote

Are you happy for Defendza to keep you informed on the latest developments in cyber security (attack reports, guidance, DIY articles)? Of course you can unsubscribe at any time. Please see our privacy policy

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Portfolio

Cloud Security

"In fact, Gartner predicts that, through 2020, 95 percent of cloud security failures will be the customer’s fault." 

                                                                             - Gartner

Majority of the infrastructure refreshes are about cloud technology to ensure a safe and secure way for the business operations. The safety of these assets is a key consideration for any management to show commitment to securing their supply chain, customer information and/or their corporate information. Our Cloud Security Service can help you assess your risks and the relevant risk mitigation steps to minimise the attack surface.

Irrespective of the cloud service model in use (Iaas, Paas, Saas), security validation is important at one or multiple stages of business lifecycle of any asset. Defendza offer security assessments of applications, infrastructure and/or configuration reviews hosted at AWS, Azure, Skyscape, Virtualized environments such as VMWare, Hyper-V.

We have a dedicated security assessments FAQ section. Read it here.

Service Offering Insights

Why choose us?

  • Extensive sector-based experience
  • Focus on service quality, insight, and client business
  • Thorough analysis and reporting to cater management and technical audience
  • Our proposals are customer centric, no fixed sales packages offered
  • Aftercare support includes debrief and help with the remediation plan

Our qualifications

Defendza as a business, as well as its consultants, are equipped with some of the best-known certifications, accreditations and qualifications globally. These include CREST, GCloud 11 Framework, ISO quality management certifications for the business and our consultants are Ex Check Team Leaders/CCT Infrastructure (2012, 2015) and Web Applications (2009,2012,2015), OSCP (Offensive Security Certified Professional), CREA (Certified Reverse Engineering Analyst), CREA (Certified Binary Auditing Expert), CISSP (Certified Information Security Systems Professional), SANS GSEC & GCIH Silver (Hacker Techniques and Incident Handling), CCNA (Cisco Certified Network Associate), CEH (Certified Ethical Hacker). 

Key benefits

Conducting regular penetration assessment offers the following benefits:

  • Assess your security controls and approach towards cyberattack preparedness
  • Manage your network based risks in a structured and organised manner.
  • Evidence of compliance with ever changing regulatory/certification requirements.
  • Assess your corporate security culture including passwords, patching, and auditing, logging and information storage practices.
  • Assuring your supply chain (suppliers, vendors) that you take the security of your data seriously.
  • Protect your client loyalty and brand image by demonstrating security adherence.

Different types of Cloud Security Assessments

Defendza Ltd are an accredited CREST penetration testing service provider. This ensures we adhere to high technical standards and code of conduct in place by CREST. 

  • Cloud Penetration Testing (component focussed)
  • Cloud Security Health Checks (estate wide)
  • Cloud Configuration Reviews (asset focussed)
  • AWS, Azure Security Reviews 
  • Cloud Solution Reviews (Saas offerings)

Reasons for Cloud Security Assessments?

Cloud applications and technologies are increasing exponentially to address scalability, speed and reliability issues over on-premise setups. A small misconfiguration such as permissions weakness could expose a company's database or other service putting data in full internet view. Defendza help businesses to ensure their cloud assets are secure before being adopted by the users.

Our Approach

Our cloud security offerings are based on extensive methodlogy we have developed with years of experience working across different sectors. It's very important that a cyber security consultancy follows an approach that delivers right returns on your investment. At a high level, our approach towards cloud security assessments is as follows:

Step. 1
Identity and Access Management

This phase involves reviewing identity and access management related controls. Generally, these include checks on the use of higher privilege accounts, use of MFA, password policy, IAM policies, access keys and credentials usage policies. 

01

Step. 2
Review Authentication Architectures

Authentication and authorization problems are prevalent security vulnerabilities. Most mobile apps implement user authentication. Even though part of the authentication and state management logic is performed by the back end service, authentication is such an integral part of most mobile app architectures that understanding its common implementations is important.

02

Step. 3
Network Security

This area involves checks around network security controls such as ingress, egress rulesets, flow logging, traffic restrictions, and least access privileges.

03

Step. 4
Logging API Calls, Events

All major cloud service providers offer web services that record API calls for tenant account. This information contains various parameters such as API source, calls details, requests/response elements. This phase includes a review of API calls for an account, log file validation, encryption at rest, access checks if logs are restricted from public view and access logging, configuration management and monitoring options.

04

Step. 5
Monitoring

The monitoring phase is one of the critical tasks responsible for alerting relevant contacts during an incident. This involves reliance on the logging and related configuration parameters to ensure right metric filters are in place. These reviews include checks for real-time monitoring configuration, alarms for any changes made to access control lists, security policy/groups, routing tables, and related parameters.

05

Related News

Samsung TVs should be regularly virus-checked

17/06/2019

Samsung Support USA tweeted about scanning QLED TV for malware viruses if it is connected to Wi-Fi. In a post tweet event, Samsung responded that they take security very seriously and our products and services are designed with security in mind.

Gov’t warns on VPN security bug

12/04/2019

The Department of Homeland Security has issued a warning that some VPN packages from Cisco, Palo Alto, F5 and Pulse may improperly secure tokens and cookies, allowing nefarious actors an opening to invade and take control over an end user’s system

Testimonials

"My experience to date with Defendza has been very positive, I look for a flexible, knowledable security "partner" when I engage a PT firm. Pentest means many things to many people and there are many different use cases for both the testing activity and the report generated and I need someone to work with me to get the absolute best value out of my security budget."

Information Security Officer
Insurance Group

Excellent people to work with. Very good knowledge of requirement and give us correct findings with excellent remedy to improve our security for our B2B portal site."

Head of Technical & Business Improvement
Leading Pharmaceutical Manufacturer

"I thought it was a highly professional and thorough exercise and I would have no hesitation recommending Defendza to any of my connections."

Director, Software Engineering
Global Information and Analytics Company

"Good personal service. We are delighted with the work Defendza did for us. Highly recommended."

CTO
Manchester headquartered Global Fashion Brand

"Extremely satisfied with approach, speed and end results. Thanks."

COO
International fashion label and store

"My experience of the Defendza team was 5 star.  They were so helpful, and their technical delivery and client communication were excellent."

Director, Software Development
Corporate Services Company