Cloud Security
Services

ABIR Network’s Compliance scanning and monitoring offers hundreds of Best Practice Checks, many of which can be automatically fixed upon detection. These cloud data security checks are mapped to industry regulations, so organizations can be “assessed” on their compliance with 35 standards including PCI DSS, HIPAA, NIST 800-53, NIST SP 800-171, SOC2, and more.

With applications hosted in cloud, there are limitations on what can and what cannot be tested. The methodologies used to pentest traditional security infrastructure and the Cloud differ in a multitude of ways. Most of these differences refer back to the ownership of the systems. Since the cloud provider owns the core infrastructure, the methodology invoked used in traditional ‘ethical hacking’ would violate the AWS acceptable use policies and potentially invoke incident response procedures by the cloud security team.

Traditionally an IT infrastructure involved a bunch of dedicated server, static IP addresses, and a clear network perimeter. In the cloud we have a pool of infrastructure with dynamic IP addresses, and no clear perimeter.
This shift in operating models requires a different approach to security. Instead of focusing on a secure network perimeter with the assumption of trust, the focus is to acknowledge that the network in the cloud is inherently "low trust" and move to the idea of securing infrastructure and application services themselves through a trusted source of identity and secrets management.