Automated Tools for Cloud Security Testing

TL;DR: The paper explores challenges, tools, techniques, and methodologies for cloud security testing, focusing on Azure offerings and known vulnerabilities. It introduces tools offered by major CSPs, published vulnerabilities, and API vulnerabilities according to OWASP.

Abstract: The fast growth of cloud computing technology has led to immense development in the public and private sectors.Cloud computing provides a high level of virtualization, massive scalability, multitenancy, and elasticity.This has enabled organizations, academia, government departments, and the public to advance with this technology.However, they cannot assuredly place their information in the cloud due to many security threats.Cloud security plays a vital role in establishing confidence between the cloud service providers, consumers, and multi-users to maintain the security levels of their data.Moreover, in the scope of cloud computing, the importance of security testing must be considered.Security testing involves evaluating the cloud infrastructure and applications for vulnerabilities, ensuring that sensitive data remains protected.This paper focused on the challenges, tools, techniques, and methodologies for cloud security testing.Furthermore, the paper introduces the tools offered by three significant CSPs for cloud security testing and the most critical cloud vulnerabilities.It explains some published vulnerabilities around these three major CSPs.Between these three significant CSPs, we focused on Azure offerings for securing their clouds and some known tools for security testing in the cloud.Lastly, we introduced and explained the most essential API vulnerabilities according to OWASP and a suggested way to mitigate them. Literature ReviewIn the realm of cloud security testing, significant advancements have been made, particularly in the development of automated testing systems.Tao, Lin, and Lu (2015) designed a cloud platform-based automated testing system specifically for the mobile internet environment.This system leverages virtualization and automation technology to integrate mobile terminals into the cloud platform, offering a novel service known as Testing as a Service (TaaS).The system's ability to flexibly