>> Hello. In this section,
we'll talk a little bit about
vulnerability assessments and penetration tests.
This is where we find out whether
our systems are configured the way they need to be.
Starting with vulnerability assessments.
These are passive activities.
What that means is the person conducting
them is looking for vulnerabilities,
but is not attempting to create an exploit.
On the test, you might see
references to the least intrusive method.
Well, a vulnerability scan,
it's going to be much less
intrusive than a penetration test.
They're pointing you to that direction,
so what we're doing here is in
vulnerability scan is looking for known vulnerabilities.
These are things like weak passwords, open ports,
unpatched systems, things that
shouldn't be on the network, but are.
For example, unauthorized wireless access points.
Now, an attacker would want this information.
These scans can be used for good or for evil.
Tools that we can use includes
sniffers and intrusion detection systems.
These things examine traffic on the network that is
going to a specific host or network segment.
They look for encrypted traffic and so forth.
Now once we gather that information
from a vulnerability scan,
we can then move in as pen testers and do
the active portion of
the test where we can try to create an exploit.
For example, maybe I see
that a port 80 is open on a system.
Can I send malware in through port 80?
Now, pen testing is often
referred to as ethical hacking,
but it's only ethical if you have permission.
You want permission from senior management
as high up as you can get it.
Now, when you meet with leadership to talk about this,
you'll have them complete a document
called the rules of engagement.
Many of us have worked off of this statement of work,
and that can be fine for most things but a pen test,
you want to separate document that specifies
what can be used and what can't be used.
What are the rules of engagement,
what servers can be scanned.
What tools can be used?
During what hours can the test occur?
Are there exceptions?
You want to make sure you aren't scanning the
anesthesia server right in the middle of surgery,
for example, that sign off from
senior leadership will protect you in the process.
Now, the way the steps of pen testing work,
There's obviously planning that goes into it.
As a matter of fact, vulnerability assessments are where
you gather a lot of information
you'll be using in the pen test.
That's the discovery piece.
Then the actual exploit.
We're using various tools to comprise
a system or inject malware and so forth.
But a lot of times, the system we gain
access to is not our desired target.
A lot of times we gain
access to one system and then pivot to another system.
For example, you gain access to John Smith's accounts.
That way you can pivot to
the domain controller or DNS server.
Anytime you talk about pivoting,
that means you're shifting to the real target.
Then of course, at the end of
the pen test you report on how it went.
A pen testers job is to test, is not correct.
We don't fix problems as a pen tester.
We simply test and report.
Now how much knowledge will your pen tester have?
Well, it depends on what type of
tests you want your pen testers to do.
With the black-box text you don't tell your
pen testing team any information about the organization.
They have to figure out by researching
your organization from publicly available sources.
This phase is referred to as reconnaissance,
is really stimulates how
an external attacker could
operate to try to exploit your system.
A partial knowledge pen test
simulates what a regular user might be able to do.
The team has some information about the target
and it's simulating an internal user attack.
But they don't have full access to
everything like a system administrator would have.
A full knowledge test is where the pen testers are
stimulating what an internal
system administrator could do.
They have intimate knowledge of
the target and they have full access as well.
You really need to test all of
these scenarios because you
can't predict where the threats may come from.