I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once they have been deployed to other platforms like AWS, Azure etc? Since we technically do not own the target system (we just rented a share of it), would I have to get clearance from the hosters? Obviously their implementation of a hosted service greatly affects security, so I'd like to compare the differences to our own intranet hosting.
|
|
In general, you're correct you'll need the permission of the hosting company where you are scanning services deployed on their infrastructure. This is partially so that their Intrusion Detection Systems are aware that it's an authorised scan. Both AWS and Azure have policies detailing the process and what's acceptable to test. The AWS one is here and the Azure one is here . If a hosting company doesn't have a published policy, it's worth contacting them to check. |
|||
|
|
