All right.
Hello and welcome back to the official start cop Ebonics and testing series.
We're going to do an introduction to pen testing or penetration testing as it's more commonly known.
And this is our table of contents or outline.
We're going to cover what is penetration testing exactly.
Why would companies want to conduct penetration testing?
We're also going to look at the different security training exercises.
We'll look at penetration testing methodologies.
We'll look at how to plan for penetration testing and some of the legal considerations for it.
Depending on where you are in the world, you may have different sets of rules or can testing.
Also look at the different types of penetration tests and we'll cover some of the testing objectives
as well as review questions at the end of the presentation.
So penetration testing.
So hackers are breaking into systems for profit.
Before it was about intellectual curiosity, pursuit of knowledge and the thrill.
And now hacking is big business, according to Kevin Mitnick.
You might know from some of the great exploits in the eighties and nineties at a very young age, he
was known to have acting skills and he's since reinvented himself as an ethical hacker.
Works for a company called No Before, but in several books on hacking, he's probably the most famous
hacker, at least of this particular timeframe.
Some people are hacking for curiosity, the thrill of getting into the system.
And now, of course, there's a lot of money to be made into it, especially with cybercrime.
So what is penetration testing?
Well, according to this special publication, 853, penetration testing is a specialized type of assessment
conducted on information systems or individual system components.
Identify vulnerabilities that could be exploited by adversaries.
The testing can either be used to validate vulnerabilities or determine the degree of resistance.
Organizational information systems have to adversaries with a set of specified constraints such as time,
resources and or scale.
So what does that tell you?
Given enough time, given enough resources.
Any system is vulnerable to an attacker.
Penetration testing can be done to try and figure out what weaknesses you have or what vulnerabilities
you might have that you want to make sure that attackers cannot be able to exploit.
So it gets you into the mindset of the attacker.
So some case studies here.
So a British student who breached security at Facebook.
It's been a couple of years now.
He was sentenced to eight months in jail despite arguing that his intentions were not malicious.
The judge, Alastair Mccreath, however, was not sympathetic to the argument that this individual Magnum
was attempting to uncover security holes was not a bit of harmless experimentation.
You access the very heart of a system of international business, of a massive size, the international
meeting that covered multiple legal jurisdictions potentially.
So this was not just dealing about in business records of some tiny business of real great importance.
You required a great deal of sensitive and confidential information.
You were not entitled to.
So potentially this could have been disastrous for the company.
None other than Facebook.
So, of course, fast forward to today.
We have things like the General Data Protection Act.
We have the Electronic Consumer Privacy Act.
We have.
Many, many other governing bodies.
We have regulatory compliance frameworks.
So the main thing to keep in mind here is if you're going to go after a target or a company, you want
to make sure that you have permission.
You want to make sure that you have authorization because you can get in trouble as much as this person
did here.
So why pen testing?
Well, and try to do testing attempts to duplicate actions that adversaries adversaries take in carrying
out hostile cyber attacks against organizations.
And it can provide a more in-depth analysis of security deficiencies besides just vulnerability testing
alone.
You can do penetration testing on hardware, software, firmware.
Many different components of an information system.
And you can look at it both from a physical security perspective and a technical security perspective
as well.
So let's first define security training, exercise.
And in this case, this comes from the CSI.
4009 series.
A group responsible for defending an enterprise use of information systems by maintaining its posture
against a group of Mok.
That's.
Attackers.
So the red team, which are we have a group of people that are authorized and organized to emulate and
adversaries attack or exploitation capabilities and enterprises security posture.
The red teams objective is to improve enterprise cyber security by demonstrating the impacts of successful
attacks and by demonstrating what works for the defenders such as the Blue Team.
In an operational environment.
This is also known as the cyber red team.
What is the science?
This is the Committee on National Security Systems.
They provide a forum for discussion of policy issues and are responsible for setting national level
cyber security policies, directives, instructions, operational procedures, guidance and advisories
for the U.S. government departments, as well as agencies that work with national security systems through
the CNS issuance system.
So let's talk about the penetration testing methodology.
So there are different ways to go after a system based on either the full knowledge of the system.
Or we have tests, identification of potential vulnerabilities, and we design tests to exploit those
particular vulnerabilities.
This is designed to be more of a white box testing environment.
According to standard 15, you have the planning phase, you have the discovery and the attack phase,
which feeds back into the reporting phase.
This is from the Nest 815 series.
The planning for a penetration test.
The organisation will employ an independent penetration testing agent or penetration testing team,
perform pan testing on the system or components.
The idea is that the end testers will be impartial and they're free from any perceived or actual conflicts
of interest with regard to development, operation or management of those systems that are the targets
of the penetration testing.
So ideally, you most likely won't have this expertise in-house and may have to outsource.
The organization employees assignments.
You stimulate attempts by adversaries to compromise organizational information systems in accordance
with their own rules of engagement.
There are some legal considerations with respect to an attrition test and red teams.
There are certain contractual agreements where this is a legally enforceable agreement signed by authorized
individuals from both parties.
These agreements will outline each person's obligation in the process and will impose terms and conditions
on the pen testing.
U.S. export laws also prohibit the exporting of certain goods and services to other countries, and
organizations will still need to comply with sanctions rules and things like anti-money laundering,
amongst other restrictions.
And of course, we know U.S. export laws cover other things like encryption and arms control and many
other things like that.
So of course, then we have the topic of non-disclosure agreements or ideas.
These are confidentiality agreements.
They protect the organization's competitive advantage or protecting its proprietary information and
intellectual property.
Contracting entity will have a sworn duty to ensure that any vulnerabilities discovered during a pen
test is not used or disclosed inappropriately by the vendor or the contractor.
So the main thing to remember is that you disclose any foreign bodies that are found or in the penthouse.
Responsibly.
Don't tell the world there's a right way to do this.
You also may even need security clearances to be able to conduct a penetration test, or at the very
least, a national background check.
Now there are some other legal considerations, like a master service agreement.
Now, this is an overreaching contract that's entered into between two or more parties.
This governs the period of future in-game engagements and includes things like payment terms.
Any warranties, intellectual property ownership due to.
A proper way to resolve disputes as well as the allocation of risks and usually an indemnification clause.
Then we have the statement of work, which is the formal document which outlines the project specific
work to be executed by a vendor.
These may be included in the Master Service Agreement.
The statement of work may include the scope, location of work periods and deliverables that are required
and any industry standards as well as any special requirements and payment schedule.
So then we have the rules of engagement.
Think of this like a borrowed military term, because that's exactly what it is.
All parties have to agree to the rules of engagement before commencing any penetration testing scenarios.
Organizations will correlate and testing rules of engagement with the tools, techniques and procedures
or TTPs that are anticipated to be employed by adversaries carrying out the attacks.
Additionally, organizational risk assessments will guide decisions based on the level of autonomy or
independence required for personnel conducting penetration testing.
But to put this, in other words, the rules of engagement, what may be dependent upon production systems
may also be dependent upon the risk appetite of the organization, how much risk they are willing to
assume to their production equipment or their applications, as most organizations care about downtime.
How are the rules of engagement going to impact their.
Employees, their production systems and things like that.
The rules of engagement will typically have the following.
They'll have an introduction the purpose, the scope, any assumptions, any limitations?
Are there any logistics for the testing personnel for the test site?
And there needs to be a communication strategy.
The communication strategy applies to general communication, which discusses the frequency of and methods
of communication.
For example, identify the meeting, schedule, locations and conference call information.
If appropriate, then you have the incident handling and response process.
This section is critical in the rules of engagement because in the event an incident occurs on the network
while testing is in progress, criteria for halting the information security testing should be provided,
as well as details on the testing its course of action in the event that a test procedure negatively
impacts the network or an adversary.
Attacks the organization while the testing is underway, the organization's incident response call tree
slash chain of command should be provided in a quick reference format.
Process for reinstating the testing and resuming testing should also be provided.
And we have a number four target system in our network.
This identifies systems and or networks to be tested throughout the information security testing process.
Information said include authorised and unauthorised IP addresses or other distinguishing identifiers
if appropriate.
The systems, servers, workstations, firewalls, etc. operating systems and any applications to be
tested.
This should also.
Include any system that is not authorized for testing.
This could be called something like the excluded list.
Then you have the testing execution.
This is specific to the testing type and scope, which should detail what is allowed and what is disallowed,
and also a description of the information security testing methodology.
If necessary, you might have a separate plan that could be developed that complements the rules of
engagement as an appendix or a separate document.
Then you have the data handling components.
This is the guidelines for gathering, storing, transmitting and destroying test data and establishes
detailed, unambiguous requirements for data handling.
Keep in mind that any data that's going to be generated during this information security test will identify
vulnerabilities that an adversary can exploit.
It should be considered sensitive.
And then we have the reporting phase.
These are details and reporting requirements and the report deliverables that are expected to be provided
throughout the testing process and its conclusion.
Minimum information to be provided in each report such as vulnerabilities and expected mitigation techniques,
as well as the frequency with which the reports will be delivered, such as daily status report should
also be included.
The template may be provided as an appendix to the Rules of engagement to demonstrate specific formatting
and content.
Then there is lastly the signature page.
So the accountable party or the person is responsible such as the C.
So the CIA or the CSO should sign the rules of engagement stating that they understand the test, scope
and boundaries.
So now let's talk about some of the different types of penetration tests.
First you have blackbox testing.
This is essentially going in blind.
This is where there's no confidential information given to the security consultant except what's outlined
within the scope and the rules of engagement.
This is from the perspective of an attacker, not from the perspective of an insider.
Then you have the white box testing.
Which is where the consultants given complete knowledge to the organisation, complete access to any
information they might need for the test.
The white box.
Texting could be things like source code.
This could be.
Usernames and passwords, network diagrams, things of that nature.
With grey box testing.
You get some information, but not complete information.
White box techniques will tend to be more efficient and cost effective for finding security defects,
especially with customized applications versus black box testing.
Many tests will use both.
And this is known as grey box testing.
There are some different testing objectives to be aware of as well.
Penetration tests or engagements can be goal based or objective based to identify security shortcomings.
It can be many different objectives or why you might want to test out your network to see where your
weaknesses lie.
You can also do pain tests based on compliance reasons, such as if you're dealing with health care
data, such as and you have to comply with HIPA regulations, or maybe you have to comply with payment
card industry.
Data Security Standard.
Compliance based.
Regulations.
And lastly, you might just have testing out your red team.
So let's talk about the individual examples here.
So goal based, this type of penetration testing, attempts to evaluate the security by conducting a
simulated cyber attack as if it were actually occurring.
The objectives must be clearly defined and they can assess people, processes and technology.
This could be what is the likelihood of an attacker getting root level access to a web server?
These objectives will help the organization learn about the various assets.
Then you have compliance based like PCI, DSS, which requires that a penetration test which validates
the scope and effectiveness of segmentation controls to be done every six months or after any changes
in those controls.
So we're talking about segmenting the network.
PCI DSS, however, does not require a penetration test or even a vulnerability scan, but it does require
a risk analysis which effectively requires an organization to test out their security control.
Two of the most important ways of doing that are vulnerability scanning and penetration testing.
So it's kind of an implied task.
And thirdly, you have the Fisman.
Act four federal government information systems, which requires penetration testing to demonstrate
compliance with missed special publication 853 and to be able to obtain a PRISMA verification.
So now we have a case study.
The Bank of Jumanji is a multinational financial conglomerate with branches in the U.S. and branches
in the Netherlands and Canada.
Recently, the bank has come under attack from cybercriminals and has lost over 400,000 records in a
recent attack.
Is a penetration test recommended and what will be the perceived benefits of conducting a penetration
test?
So now we have some review questions.
So Mark is defined in the scope of penetration testing, engagement to assess the vulnerability of his
organization's branch office in Seattle, Washington.
The organization will provide basic network information and its desire to see how much more information
Mark can discover on his own.
What type of test is best recommended to achieve this objective?
In this case, the this question describes a black box test.
They don't give him very much information at all and want to see how much information he can discover
on his own.
So the correct answer to this would be a.
Now let's look at number two.
Junior is entering into an engagement with Pen Tester LLP and is desirous of protecting his organization's
proprietary information and intellectual property.
Which legal document best achieves this objective?
So we're talking about intellectual property.
We're talking about.
Of course, the nondisclosure agreement.
Number three, when conducting a penetration test, which the following documents will outline the requirement
to visit different sites.
Ms..
QUESTION The best answer is statement.
A work statement work will identify the requirement to visit different sites.
Let's go to question number four.
Duga is a defense contractor of software applications and requires a penetration test to be inducted,
which requires the contractor as security clearance before conducting the penetration test.
Which of the following is the most justified explanation for this requirement?
So in this case, we have.
The government restriction.
Let's look at number five.
ABH LLP has engaged your services as a penetration tester.
The bank currently processes online credit card payments for health care facilities throughout the world.
What type of penetration test do you believe the bank is requesting?
Because it says they are a bank and they also process credit card payments.
Most likely they're going to have to comply with it as well as the payment card industry, PCI, DSS.
So the correct answer would be the number six during a penetration testing exercise.
James accidentally gains access to a segment of the network that's classified.
The SIM of the organization triggered off an alarm.
It's now apparent the incident had taken place on the network.
Which document should James and the organization consult to address this issue?
That would be the rules of engagement.
Or be.
Let's do number seven.
You're conducting a penetration test engagement for a client.
The rules of engagement clearly defines that you should be accessing the network 1726.0.0 slash 16.
During the executing of the engagement, you were also asked to add the network 196168110 such 24,
which is used by the wireless network which the following best explains the situation in.
In this case, it would be scope creep.
Because they're adding extra things after the current rules of engagement.
Remember, you're conducting a penetration testing engagement which requires you to have validated authentication
and other information was granted you intimate knowledge of the networking environment.
Which of the testing are you likely to be conducting?
And that is white box testing because you're given intimate knowledge of network.
On the perspective of an insider.
Number nine, you're conducting a penetration test.
When the blue team identifies your scans and sets a rule on the IPS to block all traffic on the network
from your IP address, which is the following would be a best response to the situation.
Best practice would be to re scan the network using IPS evasion techniques and continue the engagement
because you want to provide the best solution.
Just don't take the first blocked IP because you can clearly obtain another IP address and move on.
Number ten, which of the following stakeholders are involved running a penetration, testing engagement?
And of course, your stakeholders are usually.
Your executive management.
Because they are the ones that are in charge.
They're the ones that are in control of the decision to accept the risk or not.
That is the end of our introduction to penetration testing and we will see you in the next module.