Let's talk about assessing security in the
cloud. Now there's really three key areas
that you want to look at when you're
assessing security in your cloud. The
first one is a security assessment itself.
Now this can either be done manually by
you or a third‑party company like a
consulting company, or this can be done
using tools. And then you'll want to do
some penetration testing of your cloud
environment, and again, this can be done
by your team or it can be done by a
third‑party company like a consulting
firm. And the last is vulnerability
scanning, and this is really an ongoing
activity that you continue to do for your
cloud environment over its entire
lifecycle. And vulnerability scanning can
be done using tools to make this easy,
such as Security Center that's a service
in Microsoft Azure Cloud. Now there are
many vulnerability scanning tools out
there, and many cloud providers today will
have their own vulnerability scanning tool
that you can leverage while you're running
workloads on their cloud. Let's talk about
penetration testing. So with Microsoft
Azure, you don't have to go and ask
Microsoft for permission to do penetration
testing, you can just do it, but there are
permitted and prohibited activities that
you can do, and here's a list of some of
the permitted activities. So you could do
things like port scans, you can do
vulnerability assessments, if you're
using, you know, the non‑Azure tooling to
do that. You can do, you know, increase
like the load against certain applications
that you're running in Azure, and you can
basically attempt to break some of the
services, within reason. If you do happen
to breach some of the services, you'll
want to contact Microsoft right away, and
you'll want to actually stop and contact
Microsoft right away and let them know.
Some of the prohibited services are listed
here, and a big one is basically scanning
or testing other Microsoft Cloud
customers, so trying to do penetration
testing techniques against other Microsoft
customers. That's a big no‑no. Also
another big no‑no, and this is common not
just in, you know, Microsoft Cloud but
across other clouds, is not being allowed
to do denial‑of‑service attacks, also
known as DDoS attacks, so they don't allow
this. If you do a DDoS attack, you're
probably going to get a call from
Microsoft. Now AWS is kind of the same
thing, you don't have to ask them for
approval before you do penetration
testing. They do have eight services that
are listed where you don't have to ask for
approval. If it's services outside of
these eight, you will have to ask for
approval. And here are those eight
services that are permitted for trying
your penetration testing. Now they have
prohibited activities as well, and these
are things like zone walking using their
Route 53 service, and again, DDoS, they
don't want you doing DDoS attacks against
the cloud environment, and things like request flooding.