1

One client has recently implemented AWS and has a EC2 instance running.

We have made one scoping call and further to that they provided me with a diagram that I have modified to avoid any issue:

enter image description here

The objective is to make sure there is not data leakage.

The instance will only be used by the company employees and to store orders or products specifications but doesn't fall under PCI DSS compliance requirements, it is a testing environment that they have.

The information I could find is that there are three areas when it comes to DWH testing: Unit, Integration and System Testing.

I also found here that there is a section that mentions testing under Testing Operational Environment, but it seems to be talking about a specific document that outlines the disallowed operations and devising tests for each, is that what I should test against?

Or should I check that the item protects data and maintains functionality as intended? In this case, I would test the ETL procedures, Database and Front-end?

Last but not least, is it the same to test a DWH in an AWS environment as opposed to another environment?

3
  • In regards to your question about testing in AWS, they do have strict requirements about conducting pen tests: aws.amazon.com/premiumsupport/knowledge-center/… If I recall right, there are some configurations you aren't allowed to test against at all.
    – Jin
    Jul 26, 2016 at 20:34
  • Thanks @Jin, the client had already sent the request form, I have tested AWS before, but not the systems they are asking. Yes, it's only possible to test EC2 and RDS.
    – winsmak
    Jul 26, 2016 at 22:19

1 Answer 1

1

The methodology you are looking at is not designed for penetration testing.

From the same url at that website:

The aim of system test is to test all of the following areas.

Scheduling software
Day-to-day operational procedures
Backup recovery strategy
Management and scheduling tools
Overnight processing
Query performance

...and..

There are a number of aspects that need to be tested. These aspects are listed below.

Security - A separate security document is required for security testing. This document contains a list of disallowed operations and devising tests for each.

That said when performing penetration testing against a Data Warehouse the areas that are usually unique fall into the use of non-standard databases and nonstandard protocols. These are frequently, but not always, NoSQL databases like Hadoop, Apache Spark, Cassandra, MongoDB, Green Plum many of these have their own unique vulnerabilities or use very unique protocols or messaging systems which have to be tested separately. Likewise some of these like Hadoop tend to extend database administration rights to the attached systems due to the way some of the protocols work (deployments may vary). Testing and securing these systems is a huge issue beyond the scope this type of answer but hopefully this helps you with your testing process.

As a side note: Penetration testing AWS services, especially the server-less components like Lambda can be very unique so you'll have to do all that work as well. Again this is beyond the scope of your question but I thought I'd mention it as it's directly relevant to the details in the question you asked.

4
  • Thanks! So there is in fact a way to perform a penetration test against a Data Warehouse?
    – winsmak
    Jul 26, 2016 at 22:22
  • Yes but its a lot of work depending on the system. Jul 26, 2016 at 22:40
  • In their case they only have this Data Warehouse that sits in their AWS VPC. They only have one instance of EC2 and another of RDS.
    – winsmak
    Jul 26, 2016 at 23:37
  • 1
    Sounds fairly straightforward then. I've done some huge ones for well-known Fortune 500's and been surprised at how many different ways third parties could access the data. Likewise there are some horrendous protocols in use with these things that were never meant to be publicly accessible and repeatedly lots of companies open them up to the world. Entering the names of these databases into search tools like Shodan.io is always fun too. Jul 26, 2016 at 23:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .