Cloud misconfiguration: five checks for the first hour

Cloud platforms are secure by design in many respects, and easy to misconfigure. These five checks take about an hour and often find something.

1. Public storage. Are any storage buckets or file shares readable by anyone on the internet, and should they be?
2. Open management ports. Are remote-access and database ports reachable from everywhere, rather than from a small set of addresses?
3. Overpowered identities. Which accounts and service roles have administrator rights, and do they need them?
4. Missing second factor. Do all human accounts, especially administrators, use multi-factor authentication?
5. Forgotten resources. Test servers, old snapshots and unused keys still running or valid.

After the hour

Write down what you found and fix the exposures that are reachable from the internet first. A penetration test then looks at how these settings combine with the application on top of them.