Challenge
A healthcare software company hosts its product in the cloud. Its customers are healthcare organizations, and they ask for evidence that the environment has been tested by someone independent.
The company wanted that evidence to be routine: a report it could hand over on request, produced on a schedule, by someone who understood how the platform was built.
Approach
Each year we test the production environment from the public internet, following two test cases agreed with the company.
- Confirm the scope: every public address and service the environment exposes.
- Test as an anonymous outsider, with no access granted by the firewall.
- Test again from a trusted address, the way an authorized customer connects.
- Scan what answers against the public catalog of known vulnerabilities.
- Write up the scope, the method and the findings in plain language.
Result
The company has a dated report to hand to any customer who asks, and a testing routine that repeats on schedule.
- Evidence ready for customer security reviews.
- Confirmation that only the intended services are exposed.
- A clear statement of what the cloud provider's own certifications cover.
Our advice
Decide what an outsider should be able to reach before you test. A test is far more useful when you can compare what was found with what you intended.
Related service: IT security & penetration testing.