Kaspersky explains how cloud pentests can cross trust boundaries

Kaspersky Security Services researchers say cloud penetration tests should focus on whether an attacker can cross trust boundaries, rather than simply finding open ports or achieving code execution. They divide cloud platforms into three broad layers: the public-facing External layer, the Overlay of service runtimes and provider management systems, and the Underlay of hosts, hypervisors, storage and networks.

The same managed service can be built on very different architectures, so testers must map components and permissions rather than infer how a platform works from its product name.

The researchers describe two common routes into provider systems: executing code in a service runtime and then finding credentials, or obtaining valid credentials such as an over-privileged service-account token. Network access alone does not confirm a breach; evidence requires showing that the attacker can authenticate, has permission to affect a resource beyond the original boundary, and can safely demonstrate that action.

The researchers cite the public ChaosDB and Azurescape cases as examples of attack chains involving tenant isolation and service-account access. They also discuss risks from provider workers, supply-chain systems and virtual-machine escapes, while cautioning that a public vulnerability does not establish that a particular cloud is exposed.

Kaspersky recommends agreeing testing limits and stop conditions with the provider in advance. Cross-tenant impact should be demonstrated using test accounts and synthetic data, and provider-level effects on dedicated test resources. Testing provider infrastructure requires the platform owner’s separate authorisation; testing a customer’s own resources does not automatically permit probing that infrastructure.