To better understand where your customer, where the company is
coming from, let's actually dive into what audits look like
and what they do.
So a company may be doing an audit for compliance.
They want to take credit card information
and so they have to be in compliance.
Perhaps they're working with the US government
and they have to be in compliance there.
Or maybe a company just wants to do their due diligence.
Maybe they're not compelled by any regulation,
but they just want to be secure because they have--
they feel that they need to provide that
to themselves and to their customers.
Well, auditing is the way that a company can check and see
whether they, themselves, are in compliance.
Or a third party can come in and run an audit
to see if they are following the guidelines.
It can start with interviews.
Interviewing your CISO, your system admins,
whoever is touching, creating, using information
that is included, they could all be brought in for interviews.
Were-- maybe your workers, they could be asked,
were you given any security awareness training this year?
What practices do you know about?
What practices are you forced into?
Can you plug in USBs?
Do you have access to the building via some sort
of multi-factor authentication?
Do you have access to your machine via some sort
of multi-factor authentication?
By doing interviews, they don't just get one person's view
on things.
They get the full scope, picture,
of the whole environment.
Often, there's review of paperwork.
So a lot of compliance is you have
to keep these records in this way
and going back and reviewing, OK,
if you've got a policy that you have
to do exit interviews for every new employee and maybe
at a certain date before they leave you do this, that,
and the other to pull their credentials
and prevent loss of data, how do you keep records of those?
Can you show me logs of having done this in the past?
So a review of paperwork, or records, is quite useful.
Then there's some tools that are automated.
So there are some technical controls
that need to be in place.
Maybe it's firewalls, antivirus, different rules
on your machines or different software
that's required to be installed to be in compliance.
And those can be checked fairly simply
with tools like a Nessus scan or SolarWinds auditing tools.
And they can give you a good picture
of what the organization already looks like.
As a pen tester, you can utilize some of these tools.
They can be a great way to find vulnerabilities.
A lot of that is often baked in.
Sometimes you can find vulnerabilities and just
weaknesses that they think they've already taken care of,
but maybe they haven't actually mitigated or even addressed
some of their vulnerabilities.
If you have the ability to run a Nessus scan on a victim system,
on a network that you are auditing
and that you're pen testing, then you
can get back quite a lot of useful information.
As a pen tester, if you were doing
an audit, or an assessment, a pen test,
whatever way you were working with the company,
you need to take some good notes.
There are many different tools and ways of taking good notes.
Joplin has some auto-archiving functionality.
Sublime Text, depending-- you can put things in markdown.
You can put them in plain text.
OneNote is often a very useful tool
because you can collaborate with other members of your team
or ship things into a useful format for your report.
It allows for-- all of these allow
for different sorts of structuring so that you can
take the information that you gather
doing your pen test or your audit
and making a useful report in the end.
Another useful way of sharing information
at the end of your report is a mind map,
putting useful information together in such a way
that it flows and is followable by your customer.
Reports are crucial.
You're not getting paid for your pen test.
You're getting paid for your report that
goes with your pen test.
That might be something new to think about.
A lot of training around penetration testing
focuses on scans and vulnerabilities, zero days
and exploits.
In the end, what you, as a pen tester, gets paid for
is turning in a report that adds value to the company.
What they do with the report is largely up to them.
What you include in the report will
come from your technical expertise as well
as some of your acumen and understanding of their business
needs--
what the frameworks, what their compliance and regulations
sets fort--
and making that into a very useful package for them
at the end.
And with that, we're going to do a little bit of auditing,
play with some of these tools.
We can use them ourselves, and we do use them ourselves,
for pen testing.
But how can we mesh those two?
How can we understand where they're coming from
as well as make some useful reaches for our own needs
as pen testers?