The use of this site and the content contained therein is governed by the Terms of Use. When you use this site you acknowledge that you have read the Terms of Use and that you accept and will be bound by the terms hereof and such terms as may be modified from time to time.
All text, graphics, audio, design and other works on the site are the copyrighted works of nasscom unless otherwise indicated. All rights reserved.
Content on the site is for personal use only and may be downloaded provided the material is kept intact and there is no violation of the copyrights, trademarks, and other proprietary rights. Any alteration of the material or use of the material contained in the site for any other purpose is a violation of the copyright of nasscom and / or its affiliates or associates or of its third-party information providers. This material cannot be copied, reproduced, republished, uploaded, posted, transmitted or distributed in any way for non-personal use without obtaining the prior permission from nasscom.
The nasscom Members login is for the reference of only registered nasscom Member Companies.
nasscom reserves the right to modify the terms of use of any service without any liability. nasscom reserves the right to take all measures necessary to prevent access to any service or termination of service if the terms of use are not complied with or are contravened or there is any violation of copyright, trademark or other proprietary right.
From time to time nasscom may supplement these terms of use with additional terms pertaining to specific content (additional terms). Such additional terms are hereby incorporated by reference into these Terms of Use.
Disclaimer
The Company information provided on the nasscom web site is as per data collected by companies. nasscom is not liable on the authenticity of such data.
nasscom has exercised due diligence in checking the correctness and authenticity of the information contained in the site, but nasscom or any of its affiliates or associates or employees shall not be in any way responsible for any loss or damage that may arise to any person from any inadvertent error in the information contained in this site. The information from or through this site is provided "as is" and all warranties express or implied of any kind, regarding any matter pertaining to any service or channel, including without limitation the implied warranties of merchantability, fitness for a particular purpose, and non-infringement are disclaimed. nasscom and its affiliates and associates shall not be liable, at any time, for any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communications line failure, theft or destruction or unauthorised access to, alteration of, or use of information contained on the site. No representations, warranties or guarantees whatsoever are made as to the accuracy, adequacy, reliability, completeness, suitability or applicability of the information to a particular situation.
nasscom or its affiliates or associates or its employees do not provide any judgments or warranty in respect of the authenticity or correctness of the content of other services or sites to which links are provided. A link to another service or site is not an endorsement of any products or services on such site or the site.
The content provided is for information purposes alone and does not substitute for specific advice whether investment, legal, taxation or otherwise. nasscom disclaims all liability for damages caused by use of content on the site.
All responsibility and liability for any damages caused by downloading of any data is disclaimed.
nasscom reserves the right to modify, suspend / cancel, or discontinue any or all sections, or service at any time without notice.
For any grievances under the Information Technology Act 2000, please get in touch with Grievance Officer, Mr. Anirban Mandal at data-query@nasscom.in.
The cloud computing landscape has revolutionized the way businesses operate, offering scalability, agility, and cost-effectiveness. However, this shift towards cloud-based infrastructure has also introduced new security challenges. Cloud environments are inherently more complex and distributed, making them more susceptible to cyberattacks. Hence, security testing in the cloud has become an indispensable aspect of cloud security management. In the era of cloud-centric operations, safeguarding cloud-based applications has become imperative. This paper comprehensively explores the best practices for security testing in the cloud, providing a roadmap for organizations to fortify their cloud-based assets against potential threats.
41
0
Problem Statement
As organizations increasingly migrate their critical data and applications to cloud environments, there is a growing recognition of the need for robust cloud security measures. The dynamic nature of cloud computing introduces unique challenges and vulnerabilities that have the potential to compromise the confidentiality, integrity, and availability of sensitive information. The current state of cloud security is characterized by several pressing issues that demand comprehensive solutions
1. Data Breaches and Unauthorized Access
2. Insufficient Encryption Practices
3. Inadequate Incident Response and Monitoring
4. Third-Party Security Risks
5. Lack of Standardized Security Best Practices
Background
Security testing in the cloud entails evaluating cloud-based applications and their associated infrastructure for vulnerabilities and potential security weaknesses. This process encompasses various techniques, including penetration testing, vulnerability scanning, and static code analysis. The objective of security testing in the cloud is to identify and remediate vulnerabilities before they can be exploited by attackers, thereby minimizing the risk of data breaches, financial losses, and reputational damage.
Proposed Solution
Cloud services are employed for various purposes in corporate environments, ranging from storing data in services like Box, accessing productivity tools through Microsoft 365, to deploying IT infrastructure in Amazon Web Services (AWS). In all these applications, organizations leverage cloud services to enhance their operational efficiency, promoting agile technology adoption often at a reduced cost. However, the utilization of any cloud service brings forth challenges and risks related to data security in the cloud. The responsibility for securing data created in the cloud, transmitted to the cloud, and retrieved from the cloud lies with the cloud customer. Safeguarding cloud data necessitates visibility and control. The subsequent steps outline a core set of best practices for cloud security, providing guidance to enterprises in achieving a secure cloud environment and addressing cloud security concerns.
Phase 1: Understand cloud usage and risk
Step 1: Identify sensitive or regulated data.
The largest area of risk involves the loss or theft of data resulting in regulatory penalties or intellectual property loss. Data classification engines can categorize data, allowing companies to fully assess these risks.
Step 2: Understand how sensitive data is being accessed and shared.
Sensitive data can be securely held in the cloud, but companies must monitor who accesses it and where it goes. Assessing permissions on files and folders of the cloud environment, along with access context like user roles, user location, and device type, is crucial.
Step 3: Discover shadow IT (unknown cloud use).
Most individuals do not consult their IT team before signing up for a cloud storage account or converting a PDF online. Utilize web proxy, firewall, or SIEM logs to discover unknown cloud services in use, and then assess their risk profiles.
Step 4: Uncover malicious user behavior.
Both careless employees and third-party attackers can exhibit behavior indicating malicious use of cloud data. User behavior analytics (UBA) can monitor anomalies and mitigate both internal and external data loss.
Phase 2: Protect your cloud
Step 1: Apply data protection policies.
With data classified as sensitive or regulated, assign policies governing what data can be stored in the cloud. Quarantine or remove sensitive data found in the cloud and coach users in case of policy violations.
Step 2: Encrypt sensitive data with your own keys.
While encryption available within a cloud service protects data from outside parties, the cloud service provider still has access to encryption keys. Encrypt data using your own keys for full control while allowing users to work with the data seamlessly.
Step 3: Set limitations on how data is shared to managed and unmanaged devices.
Enforce access control policies from the moment data enters the cloud, setting user or group permissions and controlling external sharing through shared links.
Step 4: Apply advanced malware protection to infrastructure-as-a-service (IaaS) such as AWS or Azure.
In IaaS environments, where security responsibilities lie with the user, apply anti-malware technology to the operating systems, applications, and network traffic. Deploy application whitelisting, memory exploit prevention for single-purpose workloads, and machine-learning-based protection for general-purpose workloads and file stores.
Benefits, Cost and risk effective security solution
Why is Cloud Security Testing important?
Cloud security testing is one of the most important things you need to ensure companies cloud infrastructure is safe from hackers. As the cloud computing market is growing rapidly, there is a growing need for application security solutions for the cloud to ensure that businesses are protected from cyber-attacks. Cloud security testing helps to identify potential security vulnerabilities due to which an organization can suffer from massive data theft or service disruption. Cloud security testing is useful for both organizations and cloud security auditors. Companies can use cloud security testing to identify vulnerabilities that hackers can exploit to compromise cloud infrastructure. Cloud security auditors can use cloud security testing reports to validate the cloud infrastructure security posture. Nowadays, all or most of the applications are hosted in the Cloud. Security is one of the major problems for applications. The main objective of Cloud-based security is to stop any threat or malware from accessing, stealing, or manipulating any of our confidential data. It identifies the threats in the system and measures its potential vulnerabilities. Also, it helps in detecting any security risks in the system and helps developers in fixing those problems through coding. Cloud-based Application Security Testing gives the feasibility to host the security testing tools on the Cloud for testing. With this process, tools on the Cloud can test the applications. Previously, in traditional testing, companies need to have on-premises tools and infrastructure. Now, enterprises are adopting Cloud-based testing techniques, which make the process faster, and cost-effective.
Types of Testing Performed in Cloud
Testing in a cloud ensures that functional needs are met and emphasis the needs to be placed on nonfunctional testing. Here are several types of testing performed in the Cloud:
Functional Testing: It ensures requirements are satisfied by the application.
System Testing: This technique evaluates requirements & functionalities from end-to-end perspective.
Acceptance Testing: It ensures that the software is ready to be used by an End-User.
Non-functional Testing: This testing is to ensure that the expected requirements are met, including Quality of service, Usability, Reliability, and Response time.
Security Testing: It examines the app and ensures six basic principles - Authorization, Availability, Confidentiality, Authentication, Integrity, and Non-repudiation.
Scalability and Performance Testing: These testing helps to understand the system behavior under a certain expected load.
Compatibility Testing: It ensures compatibility with various cloud environments and instances of different operating systems.
Disaster Recovery Testing: Recovery Testing allows to evaluate disaster recovery time & ensure that the application is available to the user again with minimum data Loss
Multi-Tenancy testing: This testing refers to software architecture in which its single instance runs on server & serves multiple tenants. In this testing, cloud environment aims at providing a dedicated share of the instance to every tenant including, tenant individual functionality, data, user management, configuration, and non-functional properties
A wide range of testing tools is used in the testing of cloud-based applications. Some of them are as follows:
SOASTA CloudTest: CloudTest is one of the largest, highly scalable, and global load testing platforms that help you to quickly validate if your project is ready for success.
OWASP ZAP (Zed Attack Proxy): It is an open-source security testing tool designed to find vulnerabilities in web applications and it provides automated scanners as well as various tools for manual testing.
LoadStorm: Load Storm has a simple user interface. It can generate scripts representing different user types and allocate the right volume to each.
BlazeMeter: Blaze Meter is delivered as a self-service web application for developers and Quality Assurance (QA) professionals providing a comprehensive easy-to-use load and performance testing solution. It can even generate a report on the most complex load testing requirements and environments.
Nessus: This cloud-testing tool can be used to detect misconfigurations, vulnerabilities, and missing patches. This cloud-testing tool is a boon for banking and healthcare industries as it can generate an audit report as well. This tool is one of the most widely used testing tools and its benefits are not just limited only to healthcare and banking but for other industries as well.
Burp Suite: it is a comprehensive platform for web application security testing. It includes features for scanning, crawling, and analyzing web applications for security vulnerabilities
App Perfect: This tool concentrates on Cloud testing for web applications, wherein we can do functional tests and load tests for web applications using real traffic over the Internet. We can test web applications on different browsers, hardware, and operating system combinations by using the Cloud Testing framework. We can design, develop, and execute your tests using the company's servers over the cloud infrastructure.
Watir: As it is an open-source and effective tool, you do not have to spend anything to use it. It consists of Ruby libraries, which makes the tool more user-friendly and powerful.
Conclusion
Security testing in the cloud represents a crucial element in the cloud security strategy of any organization. Through the adoption of a comprehensive and proactive approach to cloud security testing, organizations can proficiently recognize, prioritize, and address vulnerabilities before potential exploitation. This process aids in safeguarding digital assets, ensuring compliance, and cultivating trust among customers and partners within the dynamic digital landscape.
That the contents of third-party research report/s published here on the website, and the interpretation of all information in the report/s such as data, maps, numbers etc. displayed in the content and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party research report/s published, are provided solely as convenience; and the presence of these research report/s should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these research report/s, you do so at your own risk.
NASSCOM GCC Council launches the GCC Newsletter!
NASSCOM GCC Council is focused on ensuring that we bring together industry thought leadership, best practices, and experiences that can help expedite the journey of our member community to excellence. The community has shown great camaraderie and character in being forthcoming with their stories and successes with the intent of establishing a strong GCC ecosystem in India. The NASSCOM GCC Newsletter is a step forward in ensuring access, availability, and dissemination of these extremely relevant points of view, leadership interviews, reports, and other assets to a wider audience across the GCC Community.
In the midst of the Covid crisis, globally, we are witnessing a period of ‘resilience’ as economies and businesses are recouping from the pandemic-induced damages, while navigating the ever-changing dynamics around them. Owing to these paradigm shifts, enterprises across the world are altering their strategies and reinventing themselves on multiple fronts as they enter 2022.
Each year, NASSCOM conducts a short survey aimed at gathering insightful responses from industry leaders, which helps us understand the technology industry outlook, as well as sense the overall economic and business sentiment. This year too, we carried out a similar exercise through the “NASSCOM 2022 Tech CEO Survey: Industry Outlook”, commencing January 2022, so as to comprehend the pulse of the Indian tech industry, across key parameters pertaining to business priorities and challenges, industry outlook, key growth verticals/sectors, tech spending as well as talent and hiring models. Moreover, the survey underscores high-level insights on global economic and business outlook, global tech spend and key tech focus areas; as well as the perspectives of end-user enterprises.
Responses collected from ~130 CEOs including key stakeholders in the technology industry hailing from Large, Medium and Small-size IT firms, Global Capability Centers (GCCs) and Start-ups, have been aggregated in the form of a comprehensive report that captures key findings and actionable insights.
@nasscom Insights
16 Feb 2022BPMDigital Transformation Industry Trends IT Services nasscom insights
Each year, NASSCOM publishes it’s flagship report – the Strategic Review: The Technology Sector in India – that is considered the bible for the technology industry. This year’s edition focuses on the theme “Resilience to Resurgence” and explores how various stakeholders partnered together to navigate the challenges posed by the pandemic and overcome these successfully. As a result, FY2022 is a tipping point for the industry – the year in which the industry crossed $200 Bn in total revenue and 5 Mn in total workforce. The report examines the driving factors behind this growth via the Trends that Defined FY2022.
It also analyses in detail six global megatrends that have become prominent as a result of the pandemic and how technology is being/can be leveraged to address these areas. With an aim to define the future, the report carries, for the first time ever, NASSCOM’s TECHScope Framework that has looked deep into the top 25 technology that will be key to unlocking value over the next 3 to 10 years. Finally, the report also presents the short-term outlook (FY2023) – a sentiment analysis of both the enterprise (end-user industries) and the technology industry perspectives – both indicate a highly positive outlook for technology.
NFTs (Non-Fungible Tokens) are blockchain-based digitized resources (or relics) that are unique. No two NFTs are similar. And these are items that you can consider as digital collectibles. They are not commonly tradable.
NFTs have emerged as t technological marvel that allowed communities to connect with their fans. NFTs are "exceptional" resources in the digitized world that can be purchased and sold like some piece of property. The likely utilization of NFTs is close to interminable. A few decades from now, most digital transactions are likely to involve some form of NFTs.
The objective of this study is to map the supply demand gap in India with respect to Digital tech talent in India. The model based on Zinnov’s Draup’s Proprietary Talent Database, analyses installed talent and demand, India’s talent advantage, and the way forward
@Hitesh Achra Hitesh Achra
