In this lesson, we're going to talk about
the Shared Responsibility Model
and its role in pen testing.
This model lays out the different roles and responsibilities
of various stakeholders involved in keeping
a hosted environment secure.
These stakeholders include hosting providers, customers,
penetration testers, and third-party service providers.
Now, let's get started with the hosting providers.
Their main job is to secure the infrastructure
that runs all the services offered to the customers.
This includes physical security of data centers,
network hardware, server hardware, storage,
and virtualization layers.
A common phrase you'll hear is that "the CSP
or cloud service provider is responsible for security
of the cloud and the customer is responsible
for the security in the cloud."
For instance, a hosting provider like Amazon Web Services
makes sure that the facilities are protected
against physical intrusion and that the network
and hardware can withstand attacks.
They also handle maintenance and security updates
for these components.
However, their responsibilities usually don't cover
managing the operating system or applications,
unless it's specified in the service agreement.
Now, customers have their own set of responsibilities.
They need to manage the security of
the software and systems they run
on the hosting provider's infrastructure.
This includes the operating systems, applications, and data.
For example, a company using AWS must ensure
its operating systems are patched and updated,
its applications are secure against vulnerabilities,
and that the data is protected through encryption
and access controls.
Customers also need to configure security settings
and manage network traffic controls
to meet their specific security and compliance needs.
Then we have the penetration testers,
who kind of act like external auditors
within a hared Responsibility Model.
Their main job is to find vulnerabilities
that threat actors could exploit
and test the effectiveness of the security controls.
Pen testers might simulate attacks on both
the hosting provider's infrastructure
and the customer's application to see how well they hold up.
They provide detailed reports on any vulnerabilities
they find and suggest ways to fix them
or enhance the security.
Cloud providers like AWS, Microsoft Azure,
and Google Cloud offer specialized services
to help customers understand and secure
their specific cloud environments.
AWS Trusted Advisor and AWS Inspector,
Azure Security Center and Azure Advisor,
and Google Cloud Security Command Center
and Google Cloud Armor are all examples of such services
that help improve security and compliance,
so these should be customers' first options
when it comes to assessments.
It's important to note that,
before conducting a cloud penetration test,
it's important to notify the cloud service provider.
This ensures that they're aware of the test
to avoid triggering security alarms
or violating terms of service.
And last but not least, let's discuss
third-party service providers.
Third-party service providers, such as software vendors,
external consultants, and partners
also have roles in this model.
They need to ensure that their products or services
that integrate within the customers' environments
don't introduce vulnerabilities.
For example, a vendor supplying a document management
application must ensure that their software is secure
and regularly updated to avoid compromising
the customer's data.
If third parties have access to the customer's systems
for maintenance or monitoring,
they must follow strict security protocols
to prevent any data breaches.
Let's go over a quick example
to see these responsibilities in action.
Imagine an e-commerce platform hosted on Azure.
The hosting provider, Azure,
ensures that the physical security of the data centers
and the integrity of the network and hardware.
The e-commerce company, as the customer,
is responsible for securing their virtual machines,
any applications that they create to run their businesses,
and their transaction databases.
A pen tester hired by the e-commerce company
checks the web applications and network setups regularly
to find security weaknesses.
Now, this helps make sure the company is securing
their applications, which is kind of their responsibility.
On the other hand, a third-party payment gateway
manages credit card processes.
They ensure PCI DSS compliance and secure transaction data,
which is their responsibility.
So remember, the Shared Responsibility Model
in cybersecurity means that the hosting provider
secures the infrastructure,
while the customer secures their data and applications.
Penetration testers and third-party vendors also play a role
in ensuring that overall security of the system.
By understanding and executing their
respective responsibilities, all parties contribute
to a strong defense of hosted environments,
protecting sensitive data,
and maintaining operational integrity.