1 - Intro 2 Pen Testing Flashcards
What is Pen Testing?
Evaluates an organization’s ability to protects its infrastructure from external and internal threats. Simulates an attack to analyze weaknesses and design flaws. Afterwards, a comprehensive report is provided
What are the benefits of a Pen testing?
- Identifies threats
- Provides assurance that org is at appropriate risk level
- Determines business impact
- Helps prevent exploitation
- ROI on security
- Achieves compliance
What components make up ROI?
ROI = (Expected Returns - Cost of Investment) / Cost of Investment
What is the difference between Pen Testing and Security Audits and Vulnerability Assessment?
- Security Audits checks whether the organization is following a set of policies and procedures
- Vulnerability Assessments discover vulnerabilities but does exploit them nor give any business impact.
- Pen testing incorporates audits and vulnerability assessments and demonstrates if vulnerabilities can be exploited.
What are the types of Pen Testing?
-
Black Box: Tested has no previous knowledge of target network. Takes a lot of info gathering and assessment. Can be very time consuming. Simulates real hacking.
- Blind Testing: Simulates methodologies of a real hacker
- Double-Blind Testing: Few people in the org know about the testing.
-
White Box: Tester has complete knowledge of infrastructure; tester knows exactly what they have to test.
- Announced Testing: Attempts to compromise with full cooperation/knowledge of IT staff.
- Unannounced Testing: Attempt to compromise systems without knowledge of IT security personnel. Only the upper management is aware.
- Gray Box: Combo of Black box and White box. Tester has limited knowledge; performs security assessment and testing internally. Tests apps for all vulnerabilities.
What is the cost/comprehensive structure of the types of pen testing?
Type Cost Comprehensive
Black $$ X
White $$$ XXX
Gray $ XX
How do you select the appropriate type of test?
Depends on time, goals, demands, and resources available. Black box is good for compromising security of organization. White and Gray box is useful when considering the advantage of time and resources the attacker may have.
What are the different ways of Pen Testing?
- Automated: Performed with help of various commercial and open source tools. Covers only 45% of known vulnerabilities.
- Manual: Done by an individual or group who are experts in pen testing. Reduces number of false positives.
**The ideal pen test is one that uses automated tools but is led by human intelligence and insight**
What are the different areas of Pen Testing?
- Network: Helps identify security issues in network design. (Insecure protocols, opne ports/services, unpatched OS/software, misconfiguration)
- Web Application: Detects security issues in web apps due to insecure design and development practices. (Injection vulnerabilities, broken authentication, broken session management, weak crypto, error handling)
- Social Engineering: Helps identify employees who do not properly authenticate, follow, validate, and handle the processes and technology. (Malicious emails, phishing, reveal sensitive info, allowing unauthorized entry)
- Wireless Network: Helps identify misconfigurations in wireless network infrastructure. (Rogue A.P.’s, weak encryption)
- Mobile Device: Helps identify security issues associated with mobile devices (implementation of BYOD, unauthorized mobile devices, rooted/jailbroken mobile devices, insecure WiFi networks)
- Cloud: Helps identify security issues in the cloud infrastructure (Insufficient data protection, poor access management, insecure interfaces/API, insider threats)
What is the Pen Testing process?
- Defining the Scope: Extent of testing, who and where
- Performing the Pen Test: Info gathering, testing target environment
- Reporting and Delivering Results: Listing vulnerabilities, severity, recommended fixes
What are the Pen Testing phases?
- Pre-Attack Phase: Info Gathering
- Attack Phase: Testing/Exploitation
- Post-Attack Phase: documentation and reporting
What are some Pen Testing methodologies?
A methodology ensures that the exercise is done in a standard manner with documented and repeatable results
-
Proprietary:
- EC-Council LPT
- IBM
- ISS
- McAfee Foundstone
-
Open-Source:
- OSSTMM
- ISSAF
- NIST
- OWASP
What is the EC-Council LPT Pen Testing methodology?
- Information Gathering
- Scanning and Reconnaissance
- Fingerprinting and Enumeration
- Vulnerability Assessment
- Exploit Research and Verification
- Reporting
What makes a good Pen Test?
- Establishing parameters
- Hiring skilled professionals
- Suitable set of tests
- Methodology
- Documenting the results
When should Pen Testing be performed?
- Changes in infrastructure
- A new threat is discovered
- Updated or re-installed hardware/software
- Change in organization’s policy
