In general, red teaming practices are the same whether or not your product or service is in the cloud. For example, the blue team will defend and the red team will attack. The blue team is restricted to using only tools that are in use in the production environment, while the red team can attack with any means. When you have a product or service in the cloud, there might be extra attack surfaces for the red team to test, and the blue team will need to monitor such as database connections from the cloud application back to on-premises data centers. Also, red teams will want to test any cloud services for configuration misconfigurations.




Forrester Study On The Benefits Of Cloud Vs. On-Premises AppSec