Crystal-Box Cloud (CBC) Assessment for Cloud Service Customers (CSCs)

In our security assessments for Cloud Service Customers (CSC) we focus on what lies within the sphere of control of the CSC. Analogous to a crystal-box (or white-box) application security assessment, the Crystal-box Cloud assessment (CBC) is performed with as much information available to the testers as possible. This enables the most in-depth testing to take place, and provides insight into detailed configuration settings and authorizations. In a purely application-focused assessment, this usually means that the source code is available to the testers so that complex and hard-to-find vulnerabilities can be identified. In the cloud, in addition to the source code of an application, Xpentest can identify weakness by examining the actual cloud configuration settings.

The following topics will be addressed in such an assessment: