SlideShare une entreprise Scribd logo
1  sur  23
Télécharger pour lire hors ligne
1
Enterprise Security / System Integrity
Penetration Testing
Explained
Rand Hirt, CISSP, CISA, GPEN
Sr. Security Analyst - Enterprise Security
2
Enterprise Security / System Integrity
Agenda for Today
• What is Penetration Testing?
– Definition
– Purpose
– Connection to Vulnerabilities/Exploits
– Types of Pen Tests
– Outcomes
• Why Pen Test?
– Regulatory Requirements
– Risk Profile determination
• How to Pen Test?
– Pen Test Methodology
– Reporting
– Penetration Testing Framework and PTES
– Tools - Open Source
– Tools – Commercial
• Challenges
• Takeaways
3
Enterprise Security / System Integrity
What is Penetration Testing?
Definition
• Definition = the exact meaning of a word. Despite that,
security testing vendors define their services differently using
the same words, often incorrectly.
• Penetration Test = An approach, modeling tactics of real-
world bad guys, to find vulnerabilities - then under controlled
circumstances, exploit those vulnerabilities and determine
business risk.
• Vulnerability Scan (or Security Assessment) = finding
security vulnerabilities, which may or may not be used to get
in or steal data.
Vulnerability (or Security) Assessment ≠ Penetration Test
Penetration test = focus is on actually getting in and/or
stealing data.
4
Enterprise Security / System Integrity
What is Penetration Testing? – continued
Purpose
• The ultimate goal is discovering flaws so that they can be
remediated (applying patches, reconfiguring systems,
altering the architecture, changing processes, etc.).
Connection of Vulnerabilities/Exploits to Risk
• Threat = an actor or agent that may want to or actually can
cause harm to the targeted organization.
• Vulnerability = flaw that an attacker could use to cause
damage.
• Exploit = the vehicle by which the attacker uses a
vulnerability to cause damage to the target system.
5
Enterprise Security / System Integrity
What is Penetration Testing? – continued
Connection to Vulnerabilities/Exploits
How this plays together:
Risk is where threat and vulnerability overlap. That is, we have a
risk when our systems have a vulnerability that a given threat can
attack.
6
Enterprise Security / System Integrity
What is Penetration Testing? – continued
Types of Penetration Tests
• Network services test
– Most common – finding target systems on a network.
• Client-Side test
– Designed to find exploit client-side software, such as browsers, media players, doc editing programs, etc.
• Web Application test
– Targets web-based applications in the target environment.
• Remote war dial test
– Looks for modems in the target environment and includes password guessing to attempt connecting.
• Wireless security test
– Targets the physical environment to find unauthorized wireless access points or insecure access points.
• Social engineering test
– Attempts to dupe a user into revealing sensitive information or clicking on a malicious link in an email.
7
Enterprise Security / System Integrity
What is Penetration Testing? – continued
Outcomes
To be successful, need to express our pen test findings in both
business and technical terms.
For any given risk, decision makers may conclude that, for
business purposes, they will accept a given risk identified
during a test, rather than mitigate the associated
vulnerability. In the end, it’s a business decision.
8
Enterprise Security / System Integrity
Why Pen Test?
Regulatory Requirements
Payment Card Industry (PCI) Data Security Standard
(DSS) mandates at least an annual pen test be
performed on the Cardholder Data Environment (CDE),
and/or if significant infrastructure or application
upgrades occur (PCI DSS 11.3).
9
Enterprise Security / System Integrity
Why Pen Test? - continued
Risk Profile determination
The overall objective is to reduce risk by examining the
company’s actual attack surface.
Attack surface = the sum of all potential attack vectors.
Attack vector = any single parameter (that is also vulnerable) that
can be attacked.
EXAMPLE: Networked services like File Transfer Protocol (FTP),
Internet Message Access Protocol (IMAP) and Simple Mail
Transfer Protocol (SMTP) contain unique parameters, each of
which could be exploited if not adequately protected.
10
Enterprise Security / System Integrity
How to Pen Test?
Pen Test Methodology
1. Scoping/Planning/Goal
– Constraints and limitations imposed on the team i.e. Out of scope items,
hardware, IP addresses.
– Constraints, limitations or problems encountered by the team during the actual
test
2. Reconnaissance
– The tester would attempt to gather as much information as possible about the
selected network. Reconnaissance can take two forms i.e. active and passive.
A passive attack is always the best starting point as this would normally defeat
intrusion detection systems and other forms of protection etc. afforded to the
network. This would usually involve trying to discover publicly available
information by utilizing a web browser and visiting newsgroups etc. An active
form would be more intrusive and may show up in audit logs and may take the
form of an attempted DNS zone transfer or a social engineering type of attack.
11
Enterprise Security / System Integrity
How to Pen Test?- continued
Pen Test Methodology
3. Scanning
– By use of vulnerability scanners all discovered hosts would be tested for
vulnerabilities. The result would then be analyzed to determine if there any
vulnerabilities that could be exploited to gain access to a target host on a
network.
4. Exploitation
– By use of published exploits or weaknesses found in applications, operating
system and services, access would then be attempted. This may be done
surreptitiously or by more brute force methods. An example of this would be
the use of exploit engines i.e. Metasploit or password cracking tools such as
John the Ripper.
12
Enterprise Security / System Integrity
How to Pen Test? - continued
Pen Test Methodology
5. (optional) Covering Tracks
– The ability to erase logs that may have detected the testing teams
attempts to access the network should ideally not be possible. These
logs are the first piece of evidence that may prove that a possible
breach of company security has occurred and should be protected at
all costs. An attempt to erase or alter these logs should prove
unsuccessful to ensure that if a malicious attacker did in fact get
access to the network then their every movement would be recorded.
13
Enterprise Security / System Integrity
How to Pen Test? - continued
Reporting
Reporting is crucial for sharing the findings of the
penetration test. It should not just be a “cut & paste”
process from the tool. It must have some business
impact analysis as well as quantify the business risk of
the findings.
Reports are not for impressing other pen testers. Its for
operations personnel to understand the risks and help
them mitigate the vulnerabilities.
14
Enterprise Security / System Integrity
How to Pen Test? - continued
Penetration Testing Framework and PTES
• Open-source testing methodologies exist:
– Open Source Security Testing Methodology Manual
(OSSTMM)
– Open Web Application Security Project (OWASP)
– Penetration Testing Framework
(www.vulnerabilityassessment.co.uk/Penetration%20Test.ht
ml)
– Penetration Testing Execution Standard (http://pentest-
standard.org/index.php/Main_Page)
15
Enterprise Security / System Integrity
How to Pen Test? - continued
Tools - Open Source
• Nessus (now commercial version by Tenable Security)
• Metasploit (now owned by Rapid7)
• Backtrack CD (discontinued Linux distro. with open-
source security tools – now Kali Linux)
16
Enterprise Security / System Integrity
How to Pen Test? - continued
Tools - Commercial
• Immunity CANVAS Pro
• WebInspect - HP SPI Dynamics
• CORE IMPACT & CORE Insight Enterprise
17
Enterprise Security / System Integrity
Challenges
Bad (RCPT) vs. Good Pen Testing
Really Crappy Pen Test (RCPT) - not thoroughly testing
all attributes of the attack surface, or even worse, using
vulnerability scan results and calling it a penetration
test.
A good pen test is comprehensive and looks at threat
levels at least equal to those likely to be faced in the
wild and performs testing at that level.
18
Enterprise Security / System Integrity
Challenges - continued
Skill level
Real pen testers are highly skilled professional, usually
certified to show competency, use formalized
methodology, and respect the business requirements of
the company.
They view pen testing as a logical, analytical process. It
is not just the output product of an automated scanner
(like the ones discussed earlier).
19
Enterprise Security / System Integrity
Challenges - continued
Potential adverse impacts
The goal of a penetration test is not
to just cause all sorts of damage and
expect that someone else gets to
clean up the mess.
The goal is to attempt to achieve the objective as safely
and with as little impact as possible. However, if you do
pen testing long enough, at some point you will “knock
something over” (a system may go unresponsive), so
proper Change Management is crucial in order to
account for unexpected results.
20
Enterprise Security / System Integrity
Challenges - continued
Time/Money constraints
Penetration tests are inherently constrained by time
and/or financial resources. For a specific engagement,
scoping of the pen test is crucial to success.
Also to be taken into consideration, is the intensity of
the testing to mimic the hacker level most concerning
(script kiddie, skilled hacker, and elite hacker).
21
Enterprise Security / System Integrity
Challenges - continued
Failure to address Business impact
A good pen test not only validates identified
vulnerabilities, but also discusses the business impact if
the vulnerabilities are exploited.
In addition, there should also be recommendations on
how to effectively remediate those verified
vulnerabilities.
22
Enterprise Security / System Integrity
Takeaways
There are many reasons to conduct a penetration
test:
• Compliance: Security standards like PCI require at least
annual penetration testing.
• Measuring Risk: This can inform management where
weaknesses are present and the level of risk they
present.
• Diligence: Testing to determine if software developed
internally using a Software Development Life Cycle
(SDLC) has met secure development practices and
hasn’t presented opportunities to be attacked and
exploited.
23
Enterprise Security / System Integrity
Questions?

Contenu connexe

Tendances

Penetration Testing Tutorial | Penetration Testing Tools | Cyber Security Tra...
Penetration Testing Tutorial | Penetration Testing Tools | Cyber Security Tra...Penetration Testing Tutorial | Penetration Testing Tools | Cyber Security Tra...
Penetration Testing Tutorial | Penetration Testing Tools | Cyber Security Tra...Edureka!
 
Penetration testing & Ethical Hacking
Penetration testing & Ethical HackingPenetration testing & Ethical Hacking
Penetration testing & Ethical HackingS.E. CTS CERT-GOV-MD
 
Introduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingIntroduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingAnurag Srivastava
 
Introduction to Cybersecurity
Introduction to CybersecurityIntroduction to Cybersecurity
Introduction to CybersecurityKrutarth Vasavada
 
Vulnerability and Assessment Penetration Testing
Vulnerability and Assessment Penetration TestingVulnerability and Assessment Penetration Testing
Vulnerability and Assessment Penetration TestingYvonne Marambanyika
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Managementasherad
 
Vulnerability assessment and penetration testing
Vulnerability assessment and penetration testingVulnerability assessment and penetration testing
Vulnerability assessment and penetration testingAbu Sadat Mohammed Yasin
 
Introduction To Ethical Hacking
Introduction To Ethical HackingIntroduction To Ethical Hacking
Introduction To Ethical HackingRaghav Bisht
 
Networking and penetration testing
Networking and penetration testingNetworking and penetration testing
Networking and penetration testingMohit Belwal
 
Web Application Penetration Testing
Web Application Penetration Testing Web Application Penetration Testing
Web Application Penetration Testing Priyanka Aash
 
kill-chain-presentation-v3
kill-chain-presentation-v3kill-chain-presentation-v3
kill-chain-presentation-v3Shawn Croswell
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK frameworkBhushan Gurav
 
The difference between Cybersecurity and Information Security
The difference between Cybersecurity and Information SecurityThe difference between Cybersecurity and Information Security
The difference between Cybersecurity and Information SecurityPECB
 
VAPT Services by prime
VAPT Services by primeVAPT Services by prime
VAPT Services by primePrime Infoserv
 
WTF is Penetration Testing v.2
WTF is Penetration Testing v.2WTF is Penetration Testing v.2
WTF is Penetration Testing v.2Scott Sutherland
 
Introduction To Vulnerability Assessment & Penetration Testing
Introduction To Vulnerability Assessment & Penetration TestingIntroduction To Vulnerability Assessment & Penetration Testing
Introduction To Vulnerability Assessment & Penetration TestingRaghav Bisht
 

Tendances (20)

Penetration Testing Tutorial | Penetration Testing Tools | Cyber Security Tra...
Penetration Testing Tutorial | Penetration Testing Tools | Cyber Security Tra...Penetration Testing Tutorial | Penetration Testing Tools | Cyber Security Tra...
Penetration Testing Tutorial | Penetration Testing Tools | Cyber Security Tra...
 
Penetration testing & Ethical Hacking
Penetration testing & Ethical HackingPenetration testing & Ethical Hacking
Penetration testing & Ethical Hacking
 
Introduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingIntroduction to Web Application Penetration Testing
Introduction to Web Application Penetration Testing
 
Introduction to Cybersecurity
Introduction to CybersecurityIntroduction to Cybersecurity
Introduction to Cybersecurity
 
Vulnerability and Assessment Penetration Testing
Vulnerability and Assessment Penetration TestingVulnerability and Assessment Penetration Testing
Vulnerability and Assessment Penetration Testing
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Management
 
Vulnerability assessment and penetration testing
Vulnerability assessment and penetration testingVulnerability assessment and penetration testing
Vulnerability assessment and penetration testing
 
Introduction To Ethical Hacking
Introduction To Ethical HackingIntroduction To Ethical Hacking
Introduction To Ethical Hacking
 
Networking and penetration testing
Networking and penetration testingNetworking and penetration testing
Networking and penetration testing
 
Web Application Penetration Testing
Web Application Penetration Testing Web Application Penetration Testing
Web Application Penetration Testing
 
Cyber kill chain
Cyber kill chainCyber kill chain
Cyber kill chain
 
kill-chain-presentation-v3
kill-chain-presentation-v3kill-chain-presentation-v3
kill-chain-presentation-v3
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
 
The difference between Cybersecurity and Information Security
The difference between Cybersecurity and Information SecurityThe difference between Cybersecurity and Information Security
The difference between Cybersecurity and Information Security
 
VAPT Services by prime
VAPT Services by primeVAPT Services by prime
VAPT Services by prime
 
WTF is Penetration Testing v.2
WTF is Penetration Testing v.2WTF is Penetration Testing v.2
WTF is Penetration Testing v.2
 
Introduction To Vulnerability Assessment & Penetration Testing
Introduction To Vulnerability Assessment & Penetration TestingIntroduction To Vulnerability Assessment & Penetration Testing
Introduction To Vulnerability Assessment & Penetration Testing
 
Cyber security
Cyber securityCyber security
Cyber security
 
Nessus Basics
Nessus BasicsNessus Basics
Nessus Basics
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
 

En vedette

Penetration testing
Penetration testingPenetration testing
Penetration testingAmmar WK
 
NETWORK PENETRATION TESTING
NETWORK PENETRATION TESTINGNETWORK PENETRATION TESTING
NETWORK PENETRATION TESTINGEr Vivek Rana
 
Introduction to Penetration Testing
Introduction to Penetration TestingIntroduction to Penetration Testing
Introduction to Penetration TestingAndrew McNicol
 
Vulnerability Scanning or Penetration Testing?
Vulnerability Scanning or Penetration Testing?Vulnerability Scanning or Penetration Testing?
Vulnerability Scanning or Penetration Testing?amiable_indian
 
Web Application Penetration Testing Introduction
Web Application Penetration Testing IntroductionWeb Application Penetration Testing Introduction
Web Application Penetration Testing Introductiongbud7
 
Tipos de Pentest
Tipos de PentestTipos de Pentest
Tipos de PentestRafael Seg
 
Client-Side Penetration Testing Presentation
Client-Side Penetration Testing PresentationClient-Side Penetration Testing Presentation
Client-Side Penetration Testing PresentationChris Gates
 
Hardening Enterprise Apache
Hardening Enterprise ApacheHardening Enterprise Apache
Hardening Enterprise Apacheguestd9aa5
 
SSP Presentation V2.0
SSP Presentation V2.0SSP Presentation V2.0
SSP Presentation V2.0ahaggar
 
Ed Batista, The Art of Self-Coaching @StanfordBiz, Class 5: Resilience
Ed Batista, The Art of Self-Coaching @StanfordBiz, Class 5: ResilienceEd Batista, The Art of Self-Coaching @StanfordBiz, Class 5: Resilience
Ed Batista, The Art of Self-Coaching @StanfordBiz, Class 5: ResilienceEd Batista
 
Contact Centers en Nube y Nubes de Contact Centers: Las 6 As (Any network, An...
Contact Centers en Nube y Nubes de Contact Centers: Las 6 As (Any network, An...Contact Centers en Nube y Nubes de Contact Centers: Las 6 As (Any network, An...
Contact Centers en Nube y Nubes de Contact Centers: Las 6 As (Any network, An...Mundo Contact
 
Le pentest face au droit - Cyber@Hack 2015
Le pentest face au droit - Cyber@Hack 2015Le pentest face au droit - Cyber@Hack 2015
Le pentest face au droit - Cyber@Hack 2015Benjamin Benifei
 
Hardening Linux Server Security
Hardening Linux Server SecurityHardening Linux Server Security
Hardening Linux Server SecurityIlham Kurniawan
 

En vedette (17)

Penetration testing
Penetration testingPenetration testing
Penetration testing
 
NETWORK PENETRATION TESTING
NETWORK PENETRATION TESTINGNETWORK PENETRATION TESTING
NETWORK PENETRATION TESTING
 
Introduction to Penetration Testing
Introduction to Penetration TestingIntroduction to Penetration Testing
Introduction to Penetration Testing
 
Vulnerability Scanning or Penetration Testing?
Vulnerability Scanning or Penetration Testing?Vulnerability Scanning or Penetration Testing?
Vulnerability Scanning or Penetration Testing?
 
What is pentest
What is pentestWhat is pentest
What is pentest
 
Web Application Penetration Testing Introduction
Web Application Penetration Testing IntroductionWeb Application Penetration Testing Introduction
Web Application Penetration Testing Introduction
 
Tipos de Pentest
Tipos de PentestTipos de Pentest
Tipos de Pentest
 
Ethical Hacking & Penetration Testing
Ethical Hacking & Penetration TestingEthical Hacking & Penetration Testing
Ethical Hacking & Penetration Testing
 
Client-Side Penetration Testing Presentation
Client-Side Penetration Testing PresentationClient-Side Penetration Testing Presentation
Client-Side Penetration Testing Presentation
 
Hardening Enterprise Apache
Hardening Enterprise ApacheHardening Enterprise Apache
Hardening Enterprise Apache
 
SSP Presentation V2.0
SSP Presentation V2.0SSP Presentation V2.0
SSP Presentation V2.0
 
Ed Batista, The Art of Self-Coaching @StanfordBiz, Class 5: Resilience
Ed Batista, The Art of Self-Coaching @StanfordBiz, Class 5: ResilienceEd Batista, The Art of Self-Coaching @StanfordBiz, Class 5: Resilience
Ed Batista, The Art of Self-Coaching @StanfordBiz, Class 5: Resilience
 
Presentation
PresentationPresentation
Presentation
 
Web Server Hardening
Web Server HardeningWeb Server Hardening
Web Server Hardening
 
Contact Centers en Nube y Nubes de Contact Centers: Las 6 As (Any network, An...
Contact Centers en Nube y Nubes de Contact Centers: Las 6 As (Any network, An...Contact Centers en Nube y Nubes de Contact Centers: Las 6 As (Any network, An...
Contact Centers en Nube y Nubes de Contact Centers: Las 6 As (Any network, An...
 
Le pentest face au droit - Cyber@Hack 2015
Le pentest face au droit - Cyber@Hack 2015Le pentest face au droit - Cyber@Hack 2015
Le pentest face au droit - Cyber@Hack 2015
 
Hardening Linux Server Security
Hardening Linux Server SecurityHardening Linux Server Security
Hardening Linux Server Security
 

Similaire à Pen Testing Explained

Vulnerability Ass... Penetrate What?
Vulnerability Ass... Penetrate What?Vulnerability Ass... Penetrate What?
Vulnerability Ass... Penetrate What?Jorge Orchilles
 
What is Penetration Testing?
What is Penetration Testing?What is Penetration Testing?
What is Penetration Testing?Rapid7
 
Vulnerability Assessment and Penetration Testing Framework by Falgun Rathod
Vulnerability Assessment and Penetration Testing Framework by Falgun RathodVulnerability Assessment and Penetration Testing Framework by Falgun Rathod
Vulnerability Assessment and Penetration Testing Framework by Falgun RathodFalgun Rathod
 
Itis pentest slides hyd
Itis pentest slides  hydItis pentest slides  hyd
Itis pentest slides hydRama krishna
 
The 5 Layers of Security Testing by Alan Koch
The 5 Layers of Security Testing by Alan KochThe 5 Layers of Security Testing by Alan Koch
The 5 Layers of Security Testing by Alan KochQA or the Highway
 
The 5 Layers of Security Testing by Alan Koch
The 5 Layers of Security Testing by Alan KochThe 5 Layers of Security Testing by Alan Koch
The 5 Layers of Security Testing by Alan KochQA or the Highway
 
What is penetration testing and why is it important for a business to invest ...
What is penetration testing and why is it important for a business to invest ...What is penetration testing and why is it important for a business to invest ...
What is penetration testing and why is it important for a business to invest ...Alisha Henderson
 
Increasing Value Of Security Assessment Services
Increasing Value Of Security Assessment ServicesIncreasing Value Of Security Assessment Services
Increasing Value Of Security Assessment ServicesChris Nickerson
 
Penetration testing dont just leave it to chance
Penetration testing dont just leave it to chancePenetration testing dont just leave it to chance
Penetration testing dont just leave it to chanceDr. Anish Cheriyan (PhD)
 
Penetration Testing Services - Redfox Cyber Security
Penetration Testing Services - Redfox Cyber SecurityPenetration Testing Services - Redfox Cyber Security
Penetration Testing Services - Redfox Cyber SecurityKaran Patel
 
A Brief Introduction to Penetration Testing
A Brief Introduction to Penetration TestingA Brief Introduction to Penetration Testing
A Brief Introduction to Penetration TestingEC-Council
 
CohenNancyPresentation.ppt
CohenNancyPresentation.pptCohenNancyPresentation.ppt
CohenNancyPresentation.pptmypc72
 
New Age Red Teaming - Enterprise Infilteration
New Age Red Teaming - Enterprise InfilterationNew Age Red Teaming - Enterprise Infilteration
New Age Red Teaming - Enterprise InfilterationShritam Bhowmick
 
Whitepaper: Network Penetration Testing - Happiest Minds
Whitepaper: Network Penetration Testing - Happiest MindsWhitepaper: Network Penetration Testing - Happiest Minds
Whitepaper: Network Penetration Testing - Happiest MindsHappiest Minds Technologies
 
Security Testing.pptx
Security Testing.pptxSecurity Testing.pptx
Security Testing.pptxosandadeshan
 
Penetration Testing for Cybersecurity Professionals
Penetration Testing for Cybersecurity ProfessionalsPenetration Testing for Cybersecurity Professionals
Penetration Testing for Cybersecurity Professionals211 Check
 

Similaire à Pen Testing Explained (20)

Vulnerability Ass... Penetrate What?
Vulnerability Ass... Penetrate What?Vulnerability Ass... Penetrate What?
Vulnerability Ass... Penetrate What?
 
Backtrack manual Part1
Backtrack manual Part1Backtrack manual Part1
Backtrack manual Part1
 
Penetration Testing Guide
Penetration Testing GuidePenetration Testing Guide
Penetration Testing Guide
 
What is Penetration Testing?
What is Penetration Testing?What is Penetration Testing?
What is Penetration Testing?
 
Vulnerability Assessment and Penetration Testing Framework by Falgun Rathod
Vulnerability Assessment and Penetration Testing Framework by Falgun RathodVulnerability Assessment and Penetration Testing Framework by Falgun Rathod
Vulnerability Assessment and Penetration Testing Framework by Falgun Rathod
 
Software testing overview subbu
Software testing overview subbuSoftware testing overview subbu
Software testing overview subbu
 
Itis pentest slides hyd
Itis pentest slides  hydItis pentest slides  hyd
Itis pentest slides hyd
 
The 5 Layers of Security Testing by Alan Koch
The 5 Layers of Security Testing by Alan KochThe 5 Layers of Security Testing by Alan Koch
The 5 Layers of Security Testing by Alan Koch
 
The 5 Layers of Security Testing by Alan Koch
The 5 Layers of Security Testing by Alan KochThe 5 Layers of Security Testing by Alan Koch
The 5 Layers of Security Testing by Alan Koch
 
penetration test
penetration testpenetration test
penetration test
 
What is penetration testing and why is it important for a business to invest ...
What is penetration testing and why is it important for a business to invest ...What is penetration testing and why is it important for a business to invest ...
What is penetration testing and why is it important for a business to invest ...
 
Increasing Value Of Security Assessment Services
Increasing Value Of Security Assessment ServicesIncreasing Value Of Security Assessment Services
Increasing Value Of Security Assessment Services
 
Penetration testing dont just leave it to chance
Penetration testing dont just leave it to chancePenetration testing dont just leave it to chance
Penetration testing dont just leave it to chance
 
Penetration Testing Services - Redfox Cyber Security
Penetration Testing Services - Redfox Cyber SecurityPenetration Testing Services - Redfox Cyber Security
Penetration Testing Services - Redfox Cyber Security
 
A Brief Introduction to Penetration Testing
A Brief Introduction to Penetration TestingA Brief Introduction to Penetration Testing
A Brief Introduction to Penetration Testing
 
CohenNancyPresentation.ppt
CohenNancyPresentation.pptCohenNancyPresentation.ppt
CohenNancyPresentation.ppt
 
New Age Red Teaming - Enterprise Infilteration
New Age Red Teaming - Enterprise InfilterationNew Age Red Teaming - Enterprise Infilteration
New Age Red Teaming - Enterprise Infilteration
 
Whitepaper: Network Penetration Testing - Happiest Minds
Whitepaper: Network Penetration Testing - Happiest MindsWhitepaper: Network Penetration Testing - Happiest Minds
Whitepaper: Network Penetration Testing - Happiest Minds
 
Security Testing.pptx
Security Testing.pptxSecurity Testing.pptx
Security Testing.pptx
 
Penetration Testing for Cybersecurity Professionals
Penetration Testing for Cybersecurity ProfessionalsPenetration Testing for Cybersecurity Professionals
Penetration Testing for Cybersecurity Professionals
 

Pen Testing Explained

  • 1. 1 Enterprise Security / System Integrity Penetration Testing Explained Rand Hirt, CISSP, CISA, GPEN Sr. Security Analyst - Enterprise Security
  • 2. 2 Enterprise Security / System Integrity Agenda for Today • What is Penetration Testing? – Definition – Purpose – Connection to Vulnerabilities/Exploits – Types of Pen Tests – Outcomes • Why Pen Test? – Regulatory Requirements – Risk Profile determination • How to Pen Test? – Pen Test Methodology – Reporting – Penetration Testing Framework and PTES – Tools - Open Source – Tools – Commercial • Challenges • Takeaways
  • 3. 3 Enterprise Security / System Integrity What is Penetration Testing? Definition • Definition = the exact meaning of a word. Despite that, security testing vendors define their services differently using the same words, often incorrectly. • Penetration Test = An approach, modeling tactics of real- world bad guys, to find vulnerabilities - then under controlled circumstances, exploit those vulnerabilities and determine business risk. • Vulnerability Scan (or Security Assessment) = finding security vulnerabilities, which may or may not be used to get in or steal data. Vulnerability (or Security) Assessment ≠ Penetration Test Penetration test = focus is on actually getting in and/or stealing data.
  • 4. 4 Enterprise Security / System Integrity What is Penetration Testing? – continued Purpose • The ultimate goal is discovering flaws so that they can be remediated (applying patches, reconfiguring systems, altering the architecture, changing processes, etc.). Connection of Vulnerabilities/Exploits to Risk • Threat = an actor or agent that may want to or actually can cause harm to the targeted organization. • Vulnerability = flaw that an attacker could use to cause damage. • Exploit = the vehicle by which the attacker uses a vulnerability to cause damage to the target system.
  • 5. 5 Enterprise Security / System Integrity What is Penetration Testing? – continued Connection to Vulnerabilities/Exploits How this plays together: Risk is where threat and vulnerability overlap. That is, we have a risk when our systems have a vulnerability that a given threat can attack.
  • 6. 6 Enterprise Security / System Integrity What is Penetration Testing? – continued Types of Penetration Tests • Network services test – Most common – finding target systems on a network. • Client-Side test – Designed to find exploit client-side software, such as browsers, media players, doc editing programs, etc. • Web Application test – Targets web-based applications in the target environment. • Remote war dial test – Looks for modems in the target environment and includes password guessing to attempt connecting. • Wireless security test – Targets the physical environment to find unauthorized wireless access points or insecure access points. • Social engineering test – Attempts to dupe a user into revealing sensitive information or clicking on a malicious link in an email.
  • 7. 7 Enterprise Security / System Integrity What is Penetration Testing? – continued Outcomes To be successful, need to express our pen test findings in both business and technical terms. For any given risk, decision makers may conclude that, for business purposes, they will accept a given risk identified during a test, rather than mitigate the associated vulnerability. In the end, it’s a business decision.
  • 8. 8 Enterprise Security / System Integrity Why Pen Test? Regulatory Requirements Payment Card Industry (PCI) Data Security Standard (DSS) mandates at least an annual pen test be performed on the Cardholder Data Environment (CDE), and/or if significant infrastructure or application upgrades occur (PCI DSS 11.3).
  • 9. 9 Enterprise Security / System Integrity Why Pen Test? - continued Risk Profile determination The overall objective is to reduce risk by examining the company’s actual attack surface. Attack surface = the sum of all potential attack vectors. Attack vector = any single parameter (that is also vulnerable) that can be attacked. EXAMPLE: Networked services like File Transfer Protocol (FTP), Internet Message Access Protocol (IMAP) and Simple Mail Transfer Protocol (SMTP) contain unique parameters, each of which could be exploited if not adequately protected.
  • 10. 10 Enterprise Security / System Integrity How to Pen Test? Pen Test Methodology 1. Scoping/Planning/Goal – Constraints and limitations imposed on the team i.e. Out of scope items, hardware, IP addresses. – Constraints, limitations or problems encountered by the team during the actual test 2. Reconnaissance – The tester would attempt to gather as much information as possible about the selected network. Reconnaissance can take two forms i.e. active and passive. A passive attack is always the best starting point as this would normally defeat intrusion detection systems and other forms of protection etc. afforded to the network. This would usually involve trying to discover publicly available information by utilizing a web browser and visiting newsgroups etc. An active form would be more intrusive and may show up in audit logs and may take the form of an attempted DNS zone transfer or a social engineering type of attack.
  • 11. 11 Enterprise Security / System Integrity How to Pen Test?- continued Pen Test Methodology 3. Scanning – By use of vulnerability scanners all discovered hosts would be tested for vulnerabilities. The result would then be analyzed to determine if there any vulnerabilities that could be exploited to gain access to a target host on a network. 4. Exploitation – By use of published exploits or weaknesses found in applications, operating system and services, access would then be attempted. This may be done surreptitiously or by more brute force methods. An example of this would be the use of exploit engines i.e. Metasploit or password cracking tools such as John the Ripper.
  • 12. 12 Enterprise Security / System Integrity How to Pen Test? - continued Pen Test Methodology 5. (optional) Covering Tracks – The ability to erase logs that may have detected the testing teams attempts to access the network should ideally not be possible. These logs are the first piece of evidence that may prove that a possible breach of company security has occurred and should be protected at all costs. An attempt to erase or alter these logs should prove unsuccessful to ensure that if a malicious attacker did in fact get access to the network then their every movement would be recorded.
  • 13. 13 Enterprise Security / System Integrity How to Pen Test? - continued Reporting Reporting is crucial for sharing the findings of the penetration test. It should not just be a “cut & paste” process from the tool. It must have some business impact analysis as well as quantify the business risk of the findings. Reports are not for impressing other pen testers. Its for operations personnel to understand the risks and help them mitigate the vulnerabilities.
  • 14. 14 Enterprise Security / System Integrity How to Pen Test? - continued Penetration Testing Framework and PTES • Open-source testing methodologies exist: – Open Source Security Testing Methodology Manual (OSSTMM) – Open Web Application Security Project (OWASP) – Penetration Testing Framework (www.vulnerabilityassessment.co.uk/Penetration%20Test.ht ml) – Penetration Testing Execution Standard (http://pentest- standard.org/index.php/Main_Page)
  • 15. 15 Enterprise Security / System Integrity How to Pen Test? - continued Tools - Open Source • Nessus (now commercial version by Tenable Security) • Metasploit (now owned by Rapid7) • Backtrack CD (discontinued Linux distro. with open- source security tools – now Kali Linux)
  • 16. 16 Enterprise Security / System Integrity How to Pen Test? - continued Tools - Commercial • Immunity CANVAS Pro • WebInspect - HP SPI Dynamics • CORE IMPACT & CORE Insight Enterprise
  • 17. 17 Enterprise Security / System Integrity Challenges Bad (RCPT) vs. Good Pen Testing Really Crappy Pen Test (RCPT) - not thoroughly testing all attributes of the attack surface, or even worse, using vulnerability scan results and calling it a penetration test. A good pen test is comprehensive and looks at threat levels at least equal to those likely to be faced in the wild and performs testing at that level.
  • 18. 18 Enterprise Security / System Integrity Challenges - continued Skill level Real pen testers are highly skilled professional, usually certified to show competency, use formalized methodology, and respect the business requirements of the company. They view pen testing as a logical, analytical process. It is not just the output product of an automated scanner (like the ones discussed earlier).
  • 19. 19 Enterprise Security / System Integrity Challenges - continued Potential adverse impacts The goal of a penetration test is not to just cause all sorts of damage and expect that someone else gets to clean up the mess. The goal is to attempt to achieve the objective as safely and with as little impact as possible. However, if you do pen testing long enough, at some point you will “knock something over” (a system may go unresponsive), so proper Change Management is crucial in order to account for unexpected results.
  • 20. 20 Enterprise Security / System Integrity Challenges - continued Time/Money constraints Penetration tests are inherently constrained by time and/or financial resources. For a specific engagement, scoping of the pen test is crucial to success. Also to be taken into consideration, is the intensity of the testing to mimic the hacker level most concerning (script kiddie, skilled hacker, and elite hacker).
  • 21. 21 Enterprise Security / System Integrity Challenges - continued Failure to address Business impact A good pen test not only validates identified vulnerabilities, but also discusses the business impact if the vulnerabilities are exploited. In addition, there should also be recommendations on how to effectively remediate those verified vulnerabilities.
  • 22. 22 Enterprise Security / System Integrity Takeaways There are many reasons to conduct a penetration test: • Compliance: Security standards like PCI require at least annual penetration testing. • Measuring Risk: This can inform management where weaknesses are present and the level of risk they present. • Diligence: Testing to determine if software developed internally using a Software Development Life Cycle (SDLC) has met secure development practices and hasn’t presented opportunities to be attacked and exploited.
  • 23. 23 Enterprise Security / System Integrity Questions?