General discussion


Penetration test. Why do we need it?

By shlomo.regev ·
Hello everyone,

There is no organization who do not need a security solution now days.
My first post is the penetration test.
Any organization must do a penetration test once in a while.
I do not know why, but most of the penetration tests that are made, usually, checks the IT infrastructure only.
I would like to give you a framework of a pen test that will give you the solution for your organization.

The agenda -

1- What is a penetration test.
2- Pen test methodology.
3- Reasons to perform a penetration test.
4- How to perform a pen test.
5- Final report.
6- Conclusions and implementation

What is it?

?A pen test is an evaluation of a system or networks current state of security.
?A pen test identifies vulnerabilities of a particular system, application, network, or process.
?A pen test exploits those vulnerabilities to demonstrate that the security mechanisms can and will fail.
?A pen test is the evaluation of security done by simulating an attack by a hacker.
?A pen test involves an active analysis of the system for any weaknesses, technical flaws or vulnerabilities.
-A pen test involves both internal attack scenarios and external ones.
?A pen test should be carried out on any computer system that is to be deployed in any environment.

Penetration Testing Methodology

?Let?s walk through the following major steps of a pen-test:
- Planning stage
?Gather information / Foot printing
- Scanning / Enumeration
?Verify vulnerabilities
?Exploiting / Penetrating
?Privilege escalation as required
?Prepare & Deliver Report / Presentation

Planning stage
1- The planning stage sets the objectives of the penetration test and attackers? profiles for the tests.
2- It is determined at this stage if it's a black box or white box approach.
3- A decision is to be made what are the success criteria with which organization can measure results against predetermined criteria, for both external and internal attacks.
4- It is planned whether exploits will be performed and to what extent.
5- The plan should be coordinated with the appropriate IT team in order not to cause any damages to the network.
6- Obtain management approval for the pen test.
7- A Definition of time scale is to be set.

Gather information
1- The team gathers technical details, including:
1.1- identification of network access points.
1.2- network mapping and OS fingerprinting,
about the target hosts.
2- The team gathers publicly available information on the owner of the network or application in question to plan a comprehensive attack.

Verify vulnerabilities
1- This stage is typically called vulnerability analysis
2- The team conducts the authorized attacks using public, custom, and professional tools to search for vulnerabilities in the targets, which will allow access permission.
3- These tests will expose compromised hosts that will be used as escalating points during the next stages.
4- Next, the team collates information gathered during the previous stage in order to plan a series of subsequent actions. These will include planning of the overall approach for the pen test in question, as well as formalizing which targets require further research.

1- The exploits are framed around the vulnerabilities found. A number of tools have exploit functionality built-in and provide automated results.
2- Based on analysis the team made, the pen testers perform the attack, taking advantage of system and user privileges obtained from the previous stages.
3- The team escalates the attack based on compromised hosts used as vantage points that escalate attacks to other targets and obtain elevated privileges that lead to further compromise of the network?s operating systems and corporate data.
4- Then the team continues to pivot and loop back until goals defined in the Work Plan are achieved.

1- This stage concerns cleaning up log files and making sure whatever settings or parameters were changed during the Pen Test are set back to their original condition.
2- The team cleans up all traces of the pen test by removing all testing traces of compromised systems, returning the system and any compromised hosts to the exact configurations that they had prior to the penetration test.

Report out
1- This is the most important part of the Pen Test. The final report must map the findings (vulnerabilities found, exploits performed) to the risk the company may has been exposed to if the threats were realized.
2- At this point the team is ready to report high-risk vulnerabilities to the IT decision-makers so that the IT organization is better informed and better prepared to conduct their own penetration testing or to direct additional consulting services.
3- The report will review:
* The objectives and scope of the penetration test
* Conclusions from each test phase regarding remediation required and the relative priority of these recommendations
* Details gathered on every system, including the high-risk systems found vulnerable to attack, and detailed lists of vulnerabilities.

This is it for this time, next time I will write on the reasons to preform a pen test.

If you have any comment, please do not hesitate to write them to me.



This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Related Discussions

Related Forums