Cloud Configuration Review Methodology

Cloud Configuration Review Methodology

At Fortify Solutions, our Cloud Configuration Review assesses your AWS, Azure, or Google Cloud Platform (GCP) environments against industry-recognized security standards, including the Center for Internet Security (CIS) Benchmarks.

This assessment identifies misconfigurations and security weaknesses without performing active exploitation, ensuring a safe review of your cloud environment.

Supported Cloud Platforms

• Amazon Web Services (AWS)

• Google Cloud Platform (GCP)

• Microsoft Azure

Our Review Process

1. Scope Definition & Reconnaissance

   • Understand client requirements and define in-scope environments.

   • Map architecture, services, and components to be assessed.

2. Component Enumeration

   • Perform automated discovery of cloud resources.

   • Identify active services, configurations, and dependencies.

3. Configuration Assessment

   • Automated scan against CIS Benchmarks for each cloud provider.

   • Highlight risks in IAM policies, networking, storage, logging, monitoring, and service-specific configurations.

4. Manual Verification

   • Expert review of high-impact findings.

   • Contextual risk analysis considering your business environment.

5. Reporting & Recommendations

   • Detailed report with severity-based prioritization.

   • Step-by-step remediation guidance to strengthen your cloud security posture.

6. Retesting (Optional)

   • Validate that remediated configurations are now secure.

Access Requirements

AWS

• Dedicated AWS account (per tester) with IAM API credentials.

• Access to target systems and configurations.

• Optional: Cloud architecture diagrams for context.

• Key Review Areas: IAM, CloudTrail, CloudWatch, EC2, ELB, RDS, S3, VPC, Route 53, Redshift, SES, SNS, SQS.

GCP

• Dedicated GCP account with IAM API credentials and access keys.

• Access to target systems and configurations.

• Key Review Areas: IAM, Logging, Monitoring, Networking, Virtual Machines, Storage, Cloud SQL, BigQuery.

Azure

• Dedicated Azure account with read-only IAM API credentials.

• Key Review Areas: IAM, Microsoft Defender, Storage Accounts, Databases, Logging, Networking, Virtual Machines, Key Vault, App Service.

Example Misconfigurations Detected

• Overly permissive IAM policies.

• Publicly exposed storage buckets.

• Unrestricted inbound security group rules.

• Unencrypted storage or database services.

Outcome:
You’ll receive a clear, actionable roadmap to harden your cloud environment, aligned with CIS best practices and tailored to your specific business risks.