All right, a penetration test.
What is penetration testing?
It is a methodical formal evaluation of the organization's security
that tests their ability to protect its infrastructure, network application
systems, and users against external as well as internal threats.
Effective way of determining the efficacy
of the organization's security policies, controls, and techniques.
It involves actively simulating an attack from footprinting a reconnaissance to
vulnerability discovery to exploitation to report writing.
We do again, the same thing the bad guys
do, but we do it for the purpose of fixing the holes.
You always have written permission for a
pen test as well, and you only perform the tests that have
been specified in your rules of engagement and your scope of work.
The return on investment for penetration
testing helps companies identify, understand, address vulnerabilities, saves
them a lot of money, resulting in good ROI.
Now, this may actually be a bit of a sale.
When you pitch a pen test for several thousand to tens of thousands to hundreds
of thousands of dollars, depending on the size of the organization,
they may see a lot of money going out for no immediate return.
That perspective changes dramatically when a breach occurs.
I love those memes that say security
budget before a breach, they got coins on a table, and then security budget after a
breach, they got stacks of bills and what do you need?
What do you need? Have at it.
A lot of times companies just haven't been
stung yet, so you may need to sell the benefits of a penetration test.
The return on investment is actually the expected returns minus the cost of
investment divided by the cost of the investment.
Our rules of engagement.
Rules of engagement is your formal permission to conduct penetration testing.
It provides top level guidance for conducting the test,
helps testers overcome legal, federal and policy related restrictions to
use different pen testing tools and techniques.
You're laying out exactly what you're going to do.
Everything in the rules of engagement is fair game.
It's been signed off on.
Anything that's not in the rules of engagement is not fair game.
What happens when you're doing a test and
you run into something that's an indicator of finding and you know you could go and
exploit it quite handily right there, do you exploit it?
Not if it's out of scope.
Now, if you find something and you want to
include additional tests, then you bring it to the attention of the clients.
You adjust those rules of engagement or the scope to include the tests.
But again, anything not in that rules of engagement is not fair game, technically.
But right, scoping and ROE, two aspects that need to be handled
independently while engaging a PEN testing assignment.
Scoping defines what should be tested.
Roe defines exactly how you're testing,
specifies the manner in which the test should be conducted.
I mentioned this actually in a previous slide without the text on the screen here,
but a security audit is checking for compliance.
When audits says, are we following specific standards?
A vulnerability assessment identifies the vulnerabilities but doesn't exploit them.
A pen test identifies vulnerabilities and exploits the vulnerabilities.
Couple of different flavors of Teams.
Blue teaming, red teaming.
We have purple teaming and white teaming
and probably some other colors if you want to throw them in there.
But the big two historically are blue teaming and red teaming.
Blue team is defense, security responders, so your network defenders.
Red team is offense or your attackers or offenders.
The red team may be outsourced or it may be internal.
The blue team also may be outsourced or it may be internal.
But it's the blue team's job to detect and defend.
It's the red team's job to detect, to attack.
Purple teaming is a
hybrid of both blue and red team members, both the aggressor and the defender team.
They acquire knowledge of both the red and
blue team, and the purple team can establish
continuous communication, provide real time feedback, perform frequent security
auditing, so it's a crossing between the two.
Okay, white teaming. White teaming acts as a mediator for
negotiating an engagement between a red team and a blue team.
They don't perform any testing and only
monitor the activities of the red and blue teams, responsible for
gaining insight by conducting post engagement activities.
Strategies of pen testing.
The black box, the white box, the gray box.
The black box test, there is no knowledge of the target network.
You know nothing about the target.
In a white box, clear box or crystal box
test, you know everything about the target.
In a gray box test, you know a little bit about the target.
This is directly proportionate to the
amount of information gathering and reconnaissance you need to perform.
Way more in black box, almost nothing in white box and partial in gray box.
The white box also may give you an unrealistic advantage.
A lot of times your black box test is just
a company name, allowable IP range, and away you go.
In a white box, you've got infrastructure
documentation, policies, the whole ball of wax.
The pen testing process.
First off, define the scope, the extent of the testing, what will be
tested, where testing will be performed, and who will perform the testing.
Performing the test, gathering all the information, testing the target
environment, and then reporting and delivering the
results, listing the vulnerabilities, categorizing the risks as high, medium, or
low, recommending repairs if vulnerabilities are found.
The phases of a penetration test.
The pre attack phase, research or information gathering.
You spend a lot of time in the footprinting and reconnaissance phase.
The attack phase is testing and exploitation.
The post attack phase is documentation and reporting.
There are a variety of proprietary methodologies out there.
Ec Council's licensed penetration tester Cpent.
Ibm's got their version, ISS, McAfie,
Foundstone, and then some open source methodologies.
Oss TMM is one of the big reference
standards, the Open Security Systems testing methodology manual.
Issaf, NIST, OASP, and CREST.