Ramy Al Damati

Introduction



Penetration testing is an often confused term. Through this guide Corsaire, a world leader in information security, provides a broad overview of what it means, why you would want it, and how to get the most out of the process.

• What is a penetration test?

• Why conduct penetration testing?

• What can be tested?

• What should be tested?

• What do you get for the money?

• What to do to ensure the project is a success



What is a penetration test?

Much of the confusion surrounding penetration testing stems from the fact it is a relatively recent and rapidly evolving field. Additionally, many organisations will have their own internal terminology (one man's penetration test is another's vulnerability audit or technical risk assessment).


At its simplest, a penetration-test (actually, we prefer the term security assessment) is the process of actively evaluating your information security measures. Note the emphasis on 'active' assessment; the information systems will be tested to find any security issues, as opposed to a solely theoretical or paper-based audit.


The results of the assessment will then be documented in a report, which should be presented at a debriefing session, where questions can be answered and corrective strategies can be freely discussed.




Why conduct a penetration test?

From a business perspective, penetration testing helps safeguard your organisation against failure, through:

• Preventing financial loss through fraud (hackers, extortionists and disgruntled employees) or through lost revenue due to unreliable business systems and processes.

• Proving due diligence and compliance to your industry regulators, customers and shareholders. Non-compliance can result in your organisation losing business, receiving heavy fines, gathering bad PR or ultimately failing. At a personal level it can also mean the loss of your job, prosecution and sometimes even imprisonment.

• Protecting your brand by avoiding loss of consumer confidence and business reputation.

From an operational perspective, penetration testing helps shape information security strategy through:

• Identifying vulnerabilities and quantifying their impact and likelihood so that they can be managed proactively; budget can be allocated and corrective measures implemented.




What can be tested?

All parts of the way that your organisation captures, stores and processes information can be assessed; the systems that the information is stored in, the transmission channels that transport it, and the processes and personnel that manage it. Examples of areas that are commonly tested are:

• Off-the-shelf products (operating systems, applications, databases, networking equipment etc.)

• Bespoke development (dynamic web sites, in-house applications etc.)

• Telephony (war-dialling, remote access etc.)

• Wireless (WIFI, Bluetooth, IR, GSM, RFID etc.)

• Personnel (screening process, social engineering etc.)

• Physical (access controls, dumpster diving etc.)




What should be tested?

Ideally, your organisation should have already conducted a risk assessment, so will be aware of the main threats (such as communications failure, e-commerce failure, loss of confidential information etc.), and can now use a security assessment to identify any vulnerabilities that are related to these threats. If you haven't conducted a risk assessment, then it is common to start with the areas of greatest exposure, such as the public facing systems; web sites, email gateways, remote access platforms etc.

Sometimes the 'what' of the process may be dictated by the standards that your organisation is required to comply with. For example, a credit-card handling standard (like PCI) may require that all the components that store or process card-holder data are assessed.




What do you get for the money?

While a great deal of technical effort is applied during the testing and analysis, the real value of a penetration test is in the report and debriefing that you receive at the end. If they are not clear and easy to understand, then the whole exercise is of little worth.

Ideally the report and debriefing should be broken into sections that are specifically targeted at their intended audience. Executives need the business risks and possible solutions clearly described in layman's terms, managers need a broad overview of the situation without getting lost in detail, and technical personnel need a list of vulnerabilities to address, with recommended solutions.




What to do to ensure the project is a success

Defining the scope

The scope should be clearly defined, not only in the context of the components to be (or not to be) assessed and the constraints under which testing should be conducted, but also the business and technical objectives. For example penetration testing may be focussed purely on a single application on a single server, or may be more far reaching; including all hosts attached to a particular network.




Choosing a security partner

Another critical step to ensure that your project is a success is in choosing which supplier to use.

As an absolute fundamental when choosing a security partner, first eliminate the supplier who provided the systems that will be tested. To use them will create a conflict of interest (will they really tell you that they deployed the systems insecurely, or quietly ignore some issues).

Detailed below are some questions that you might want to ask your potential security partner:

• Is security assessment their core business?

• How long have they been providing security assessment services?

• Do they offer a range of services that can be tailored to your specific needs?

• Are they vendor independent (do they have NDAs with vendors that prevent them passing information to you)?

• Do they perform their own research, or are they dependent on out-of-date information that is placed in the public domain by others?

• What are their consultant's credentials?

• How experienced are the proposed testing team (how long have they been testing, and what is their background and age)?

• Do they hold professional certifications, such as PCI, CISSP, CISA, and CHECK?

• Are they recognised contributors within the security industry (white papers, advisories, public speakers etc)?

• Are the CVs available for the team that will be working on your project?

• How would the supplier approach the project?

• Do they have a standardised methodology that meets and exceeds the common ones, such as OSSTMM, CHECK and OWASP?

• Can you get access to a sample report to assess the output (is it something you could give to your executives; do they communicate the business issues in a non-technical manner)?

• What is their policy on confidentiality?

• Do they outsource or use contractors?

• Are references available from satisfied customers in the same industry sector?

• Is there a legal agreement that will protect you from negligence on behalf of the supplier?

• Does the supplier maintain sufficient insurance cover to protect your organisation?




Standards compliance

There are a number of good standards and guidelines in relation to information security in general, for penetration tests in particular, and for the storage of certain types of data. Any provider chosen should at least have a working knowledge of these standards and would ideally be exceeding their recommendations.

Notable organisations and standards include:



PCI

The Payment Card Industry (PCI) Data Security Requirements were established in December 2004, and apply to all Members, merchants, and service providers that store, process or transmit cardholder data. As well as a requirement to comply with this standard, there is a requirement to independently prove verification.



ISACA

ISACA was established in 1967 and has become a pace-setting global organization for information governance, control, security and audit professionals. Its IS Auditing and IS Control standards are followed by practitioners worldwide and its research pinpoints professional issues challenging its constituents. CISA, the Certified Information Systems Auditor is ISACA's cornerstone certification. Since 1978, the CISA exam has measured excellence in the area of IS auditing, control and security and has grown to be globally recognized and adopted worldwide as a symbol of achievement.




CHECK

The CESG IT Health Check scheme was instigated to ensure that sensitive government networks and those constituting the GSI (Government Secure Intranet) and CNI (Critical National Infrastructure) were secured and tested to a consistent high level. The methodology aims to identify known vulnerabilities in IT systems and networks which may compromise the confidentiality, integrity or availability of information held on that IT system. In the absence of other standards, CHECK has become the de-facto standard for penetration testing in the UK. This is mainly on account of its rigorous certification process. Whilst good it only concentrates on infrastructure testing and not application. However, open source methodologies such as the following are providing viable and comprehensive alternatives, without UK Government association. It must also be noted that CHECK consultants are only required when the assessment is for HMG or related parties, and meets the requirements above. If you want a CHECK test you will need to surrender your penetration testing results to CESG.




OSSTMM

The aim of The Open Source Security Testing Methodology Manual (OSSTMM) is to set forth a standard for Internet security testing. It is intended to form a comprehensive baseline for testing that, if followed, ensures a thorough and comprehensive penetration test has been undertaken. This should enable a client to be certain of the level of technical assessment independently of other organisation concerns, such as the corporate profile of the penetration-testing provider.




OWASP

The Open Web Application Security Project (OWASP) is an Open Source community project developing software tools and knowledge based documentation that helps people secure web applications and web services. It is an open source reference point for system architects, developers, vendors, consumers and security professionals involved in designing, developing, deploying and testing the security of web applications and Web Services.



The key areas of relevance are the forthcoming Guide to Testing Security of Web Applications and Web Services and the testing tools under the development projects. The Guide to Building Secure Web Applications not only covers design principals, but also is a useful document for setting out criteria by which to assess vendors and test systems.

Read more...

One of the crucial factors in the success of a pen-test is the underlying methodology. Lack of a formal methodology means no consistency -- and I am sure -- you don't want to be the one paying and watching the testers poking around cluelessly. While a penetration tester's skills need to be specialized for the job, the approach shouldn't be. In other words, a formal methodology should provide a disciplined framework for conducting a complete and accurate penetration test, but need not be restrictive -- it should allow the tester to fully explore his intuitions.



The Open Source Security Testing Methodology Manual (OSSTMM) by Pete Herzog has become a de-facto methodology for performing penetration testing and obtaining security metrics. According to Pete Herzog, "The primary goal of the OSSTMM is to provide transparency. It provides transparency of those who have inadequate security configurations and policies. It provides transparency of those who perform inadequate security and penetration tests. It provides transparency of the unscrupulous security vendors vying to sponge up every last cent of their prey's already meager security budget; those who would side-step business values with over-hyped threats of legal compliancy, cyber-terrorism, and hackers. The OSSTMM covers the whole process of risk assessment involved in a penetration test, from initial requirements analysis to report generation. The six areas of testing methodology covered are:

• Information security

• Process security

• Internet technology security

• Communications security

• Wireless security

• Physical security


The OSSTMM focuses on the technical details of exactly which items need to be tested, what to do before, during, and after a security test, and how to measure the results. New tests for international best practices, laws, regulations, and ethical concerns are regularly added and updated.


The National Institute of Standards and Technology (NIST) discusses penetration testing in Special Publication 800-42, Guideline on Network Security Testing. NIST's methodology is less comprehensive than the OSSTMM however it is more likely to be accepted by regulatory agencies.


Another area that requires attention is the penetration testing service provider. One of the biggest fears that every organization faces during a pen-test process is the chance of sensitive information being passed on to the wrong hands. Therefore, it becomes really important to gather as much information about the company (such as their technical abilities, certifications, experiences, methodology and tools employed) and make sure that you are dealing with professionals. In addition, there are several professional and government certifications that indicate the firm's trustworthiness and conformance to industry best practice.


Standards in penetration testing


Let's take a look at some of the standards and guidelines available:


Standards for Information Systems Auditing (ISACA): ISACA was established in 1967 and has become a pace-setting global organization for information governance, control, security and audit professionals. Its IS auditing and IS control standards are followed by practitioners worldwide and its research pinpoints professional issues challenging its constituents. CISA, the Certified Information Systems Auditor is ISACA's cornerstone certification.



CHECK: The CESG IT Health Check scheme was instigated to ensure that sensitive government networks and those constituting the GSI (Government Secure Intranet) and CNI (Critical National Infrastructure) were secured and tested to a consistent high level. The methodology aims to identify known vulnerabilities in IT systems and networks which may compromise the confidentiality, integrity or availability of information held on that IT system. CHECK consultants are only required when the assessment for HMG or related parties, and meets the requirements above. In the absence of other standards, CHECK became the de-facto standard for penetration tests and penetration testing in the UK. Companies belonging to CHECK must have employees that are security cleared and have passed the CESG Hacking Assault Course. However, open source methodologies such as the following are providing viable and comprehensive alternatives, without UK Government association.



OSSTMM: The aim of The Open Source Security Testing Methodology Manual is to set forth a standard for Internet security testing. It is intended to form a comprehensive baseline for testing that, if followed, ensures a thorough and comprehensive penetration test has been undertaken. This should enable a client to be certain of the level of technical assessment independently of other organization concerns, such as the corporate profile of the penetration-testing provider.



OWASP: The Open Web Application Security Project (OWASP) is an open source community project developing software tools and knowledge based documentation that helps people secure Web applications and Web services. OWASP is an open source reference point for system architects, developers, vendors, consumers and security professionals involved in designing, developing, deploying and testing the security of Web applications and Web Services. In short, the Open Web Application Security Project aims to help everyone and anyone build more secure Web applications and Web services.



Conclusion



Security is continuum, not an absolute. The value of penetration testing lies in its results -- the ones that answer the big question "WHY?" A successful penetration test indicates more than a particular flaw, it identifies the process failures that produced the vulnerability, at the first place. Fixing or patching the vulnerability detected does not mean an end to your security worries or nightmares -- it is just the beginning of a never-ending cycle.



The CRUX: A penetration test does not guarantee absolute security – it's just a measurement of your security posture. So, "never have a false sense of security".
Read more...

Denial of Service (DoS) testing

Denial of service testing involves attempting to exploit specific weaknesses on a system by exhausting the target's resources that will cause it to stop responding to legitimate requests. This testing can be performed using automated tools or manually. The different types of DoS can be broadly classified into software exploits and flooding attacks. Decisions regarding the extent of Denial of Service testing to be incorporated into a penetration testing exercise depend on the relative importance of ongoing, continued availability of the information systems and related processing activities. Denial of service can take a number of formats; those that are important to test for are listed below:



Resource overload – these attacks intend to overload the resources (i.e. memory) of a target so that it no longer responds.

Flood attacks – this involves sending a large amount of network requests with the intention of overloading the target. This can be performed via:

ICMP (Internet Control Message Protocol), known as "smurf" attacks

UDP (User Datagram Protocol), known as "fraggle" attacks



Half open SYN attack - this involves partially opening numerous TCP connections on the target, so that legitimate connections could not be started.



Out-of-band attacks – these attempt to crash targets by breaking IP header standards:

Oversized packets (ping of death) – the packet header indicates that there is more data in the packet than there actually is.

Fragmentation (teardrop attack) – sends overlapping fragmented packets (pieces of packets) which are under length.

IP source address spoofing (land attack) – causes a computer to create a TCP connection to itself.

Malformed UDP packet header (UDP bomb) – UDP headers indicate an incorrect length.



Application security testing

With the growth of ebusiness, core business functionality is now being offered through Web-based applications. While Internet facing applications give an organization the much needed global customer reach, providing access to partners inside the intranet introduces new security vulnerabilities because, even with a firewall and other monitoring systems, security can be compromised, since traffic must be allowed to pass through the firewall. The objective of application security testing is to evaluate the controls over the application (electronic commerce servers, on-line financial applications, distributed applications, and Internet front ends to legacy systems) and its process flow. Topics to be evaluated may include the application's usage of encryption to protect the confidentiality and integrity of information, how users are authenticated, integrity of the Internet user's session with the host application, and use of cookies – a block of data stored on a customer's computer that is used by the Web server application.

Let's take a look at some important components of application testing:



Code review: Code reviews involve analysing all the application-based code to ensure that it does not contain any sensitive information that an intruder might use to exploit an application. For example: Publicly available application code may include test comments, names or clear text passwords that will give an intruder a great deal of information about the application.

Authorization testing: Involves testing the systems responsible for the initiation and maintenance of user sessions. This will require testing:

Input validation of login fields – bad characters or overlong inputs can produce unpredictable results;

Cookie security – cookies can be stolen and legitimate sessions can be used by an unauthorised individual; and

Lockout testing – testing the timeout and intrusion lockout parameters set in the application, to ensure legitimate sessions cannot be hijacked.

This is performed to discover whether the login system can be forced into permitting unauthorised access. The testing will also reveal whether the system is susceptible to denial of service attacks using the same techniques.

Functionality testing: This involves testing the systems responsible for the application's functionality as presented to a user. This will require testing:

Input validation – bad characters, specific URLs or overlong inputs can produce unpredictable results; and

Transaction testing – ensuring that the application performs to specification and does not permit the user to abuse the system.

War dialing

War dialling is a technique for systematically calling a range of telephone numbers in an attempt to identify modems, remote access devices and maintenance connections of computers that may exist on an organization's network. Using war dialing tactics, a hacker maybe able to locate vulnerable out of band entry points into an organization and manipulate them to access the network. The ignorance of IT staff in considering the phone network, as a possible primary access point is one of the main factor in the growth of these attacks. For example: leaving open modems on critical network servers, routers and other devices can inadvertently expose an entry point inside the organization's network. In this testing, once a modem or other access device has been identified, analysis and exploitation techniques are performed to assess whether this connection can be used to penetrate the organization's information systems network.

Penetration testing for wireless networks

The introduction of wireless networks, whether inside corporate network infrastructure or common homes, introduces additional security exposures that are much more threatening than wired network attacks. Since, the only boundary wireless networks know are their signals, it becomes easy for hackers to identify wireless networks simply by "driving" or walking around office buildings with their wireless network equipment- this technique is known as "war driving". Once an open wireless access point is found, the war driver usually maps it, so at the end he would have a map of access points with their properties (SSID, WEP, MAC etc.). The goal of wireless network testing is to identify security gaps or flaws in the design, implementation or operation of the organization's wireless network.

Social engineering

Often used in conjunction with blind and double blind testing, social engineering refers to techniques of exploiting the very human nature (the most exploited of all being the human sense of trust and helping gesture) with the objective of gathering information. This is done using social interaction, typically with the organization's employees, suppliers and contractors, to gather information and penetrate the organization's systems. Such techniques could include:

Non face-to-face: Posing as a representative of the IT department's help desk and asking users to divulge their user account and password information;

Face-to-face or advanced social engineering: Posing as an employee and gaining physical access to restricted areas that may house sensitive information; intercepting mail, courier packages or even trash (dumpster diving) to search for sensitive information on printed materials.

Social engineering activities can test a less technical, but equally important, security component: the ability of the organization's people to contribute to or prevent unauthorized access to information and information systems. This also helps determine the level of security awareness among employees.


Read more...

Based on specific objectives to be achieved, the different penetration testing strategies include:




External testing strategy

External testing refers to attacks on the organization's network perimeter using procedures performed from outside the organization's systems, that is, from the Internet or Extranet. This test may be performed with non-or full disclosure of the environment in question. The test typically begins with publicly accessible information about the client, followed by network enumeration, targeting the company's externally visible servers or devices, such as the domain name server (DNS), e-mail server, Web server or firewall.



Internal testing strategy

Internal testing is performed from within the organization's technology environment. This test mimics an attack on the internal network by a disgruntled employee or an authorized visitor having standard access privileges. The focus is to understand what could happen if the network perimeter were successfully penetrated or what an authorized user could do to penetrate specific information resources within the organization's network. The techniques employed are similar in both types of testing although the results can vary greatly.



Blind testing strategy

A blind testing strategy aims at simulating the actions and procedures of a real hacker. Just like a real hacking attempt, the testing team is provided with only limited or no information concerning the organization, prior to conducting the test. The penetration testing team uses publicly available information (such as corporate Web site, domain name registry, Internet discussion board, USENET and other places of information) to gather information about the target and conduct its penetration tests. Though blind testing can provide a lot of information about the organization (so called inside information) that may have been otherwise unknown -- for example, a blind penetration may uncover such issues as additional Internet access points, directly connected networks, publicly available confidential/proprietary information, etc. But it is more time consuming and expensive because of the effort required by the testing team to research the target.



Double blind testing strategy

A double-blind test is an extension of the blind testing strategy. In this exercise, the organization's IT and security staff are not notified or informed beforehand and are "blind" to the planned testing activities. Double-blind testing is an important component of testing, as it can test the organization's security monitoring and incident identification, escalation and response procedures. As clear from the objective of this test, only a few people within the organization are made aware of the testing. Normally it's only the project manager who carefully watches the whole exercise to ensure that the testing procedures and the organization's incident response procedures can be terminated when the objectives of the test have been achieved.



Targeted testing strategy

Targeted testing or the lights-turned-on approach as it is often referred to, involves both the organization's IT team and the penetration testing team to carry out the test. There is a clear understanding of the testing activities and information concerning the target and the network design. A targeted testing approach may be more efficient and cost-effective when the objective of the test is focused more on the technical setting, or on the design of the network, than on the organization's incident response and other operational procedures. Unlike blind testing, a targeted test can be executed in less time and effort, the only difference being that it may not provide as complete a picture of an organization's security vulnerabilities and response capabilities.

Now that we have explored the different strategies in penetration testing, lets take a look at some of the techniques/ methods used in a penetration test and how it helps in performing a successful penetration testing:





Passive research

As the name suggests, a passive research is a method used to gather as much information about an organization's systems configuration from public domain sources such as:

DNS (domain name service)

RIPE (Réseaux IP Européens)

USENET (newsgroups)

ARIN (American Registry for Internet Numbers)

*Passive research is generally performed at the beginning of an external penetration test.





Open source monitoring

This service is an associated technique that utilizes Internet meta-searches (multiple searches of Web sites, newswires, newsgroups and other sources) targeted on keyword that are important to the organization. The data is collected and discoveries are highlighted to the organization. This helps identify whether organization's confidential information has been leaked or whether an electronic conversation involving them has taken place. This enables an organization to take necessary measures to ensure confidentiality and integrity.



Network mapping and OS fingerprinting

Visualization of network configuration is an important part of penetration testing. Network mapping is used to create a picture of the configuration of the network being tested. A network diagram can be created which infers the logical locations and IP addresses of routers, firewalls, Web servers and other border devices.

Additionally, this examination can assist in identifying or "fingerprinting" operating systems. A combination of results from passive research and tools such as ping, traceroute and nmap, can help create a reasonably accurate network map.



An extension of network mapping is Port Scanning. This technique is aimed at identifying the type of services available on the target machine. The scan result reveals important information such as function of a computer (whether it is a Web server, mail server etc) as well as revealing ports that may be serious security risks such as telnet. Port scans should include number of individual tests, including:



TCP (Transmission Control Protocol) scan

Connect scan

SYN (or half open) scan

RST (or Xmas-tree) scan

UDP (User Datagram Protocol) and ICMP (Internet Control Message Protocol) scans. Tools such as nmap can perform this type of scan.

Dynamic ports used by RPC (Remote Procedure Call) should be scanned using tool such as RPCinfo.



Spoofing

Spoofing involves creation of TCP/IP packets using somebody else's Internet addresses and then sending the same to the targeted computer making it believe that it came from a trusted source. It is the act of using one machine to impersonate another. Routers use the "destination IP" address in order to forward packets through the Internet, but ignore the "source IP" address. The destination machine only uses that source IP address when it responds back to the source. This technique is used in internal and external penetration testing to access computers that have been instructed to only reply to specific computers. This can result in sensitive information be released to unauthorised systems. IP spoofing is also an integral part of many network attacks that do not need to see responses (blind spoofing).



Network sniffing

Sniffing is technique used to capture data as it travels across a network. Sniffing is an important information gathering technique that enables capturing of specific information, such as passwords and also an entire conversation between specific computers, if required. To perform sniffing, the network card of computer needs to be put in promiscuous mode, so that it captures all data being sent across the network.

Sniffing is extensively used in internal testing where the sniffer or the computer in promiscuous mode is directly attached to the network enabling capturing of a great deal of information. Sniffing can be performed by a number of commercial tools such as Ethereal, Network Associates SnifferPro and Network Instruments Observer.





Trojan attack

Trojans are malicious programs that are typically sent into network as e-mail attachments or transferred via IM chat rooms. These programs run in stealth mode and get installed on the client computer without the users knowledge. Once installed, they can open remote control channels to attackers or capture information. A penetration test aims at attempting to send specially prepared Trojans into a network.



Brute force attack

A brute force attack involves trying a huge number of alphanumeric combinations and exhaustive trial and error methods in order find legitimate authentication credentials. The objective behind this time consuming exercise is to gain access to the target system. Brute force attacks can overload a system and can possibly stop it from responding to legitimate requests. Additionally, if account lockout is being used, brute force attacks may close the account to legitimate users.



Vulnerability scanning/analysis

Vulnerability scanning/analysis is an exhaustive examination of targeted areas of an organization's network infrastructure aimed at determining their current state. The targets range from a single system or only critical systems to scanning the entire network. It is usually performed using automated tools that test for a multitude of potential weaknesses in a system against a database of known vulnerabilities and report potential security holes. And although they don't actively prevent attacks, many scanners provide additional tools to help fix found vulnerabilities. Some of the commonly used vulnerability scanners include: the open-source Nessus Project's Nessus, ISS Internet Scanner, GFI Software's GFI LANguard Network Security Scanner, eEye Digital Security's Retina Network Security Scanner, the BindView RMS vulnerability-management solutions and Network Associates CyberCop.



Scenario analysis

Once a vulnerability scanning has been done and weaknesses identified, the next step is to perform Scenario testing. This testing aims at exploiting identified security weaknesses to perform a system penetration that will produce a measurable result, such as stolen information, stolen usernames and passwords or system alteration. This level of testing assures that no false positives are reported and makes risk assessment of vulnerabilities much more accurate. Many tools exist to assist exploit testing, although the process is often highly manual. Exploit testing tends to be the final stage of penetration testing.


Read more...

What makes a good penetration test?




While there are clear advantages of performing a penetration test -- what makes a penetration test worth the exercise is the result. The results need to be of value and easily understandable to the client.



There's a general misconception that penetration testing is all about using fancy automated security tools and handing over the generated reports as the deliverable.


But, it takes more than just security tools to successfully conduct a penetration test. While these automated security-testing tools play an important role within the exercise, they have limitations.


The fact is that these tools can never provide a true simulation of a skilled attacker. No matter how comprehensive reporting is done by the security tools, there's always a need to explain.



Let's take a look at some of the key factors that make a good pen-test:

*  Establish the parameter: Defining the scope of work is the first and most important step to performing a successful penetration test. This will define the boundaries, objectives and the validation of procedures (the success criteria).

*  Know da man: Hire skilled and experienced consultants to perform the test- the ones who know what they are doing. In other words, separate professionals from the amateurs. Make sure they are:

-Legally capable
-Experienced
-And, abide by the non disclosure agreement.

*  Chose adequate set of tests: Manual and automated will yield the best balance of cost/benefits.

*  Follow a methodology: It's not a guessing game. Everything needs to be planned, documented and followed.

*  Resulting value: The results should be documented carefully and efforts should be made to make them understandable to the client. Whether it's a technical report or an executive summary, there is always a need to explain. The security consultant /tester should be available to answer queries or explain results.

*  Findings and recommendations: This is a very important part of a pen-test. The final report must clearly state the findings and must map the same to the potential risks. This should be accompanied by a remediation roadmap based on the BEST SECURITY PRACTICES.

Before we get into the testing strategies and techniques used in penetration testing, let's take a look at some scenarios where it can be useful:


*  Setting up a new office

Whether it's a new business set up or addition of new sites, penetration testing helps identify potential weaknesses in the network infrastructure. For example, an Internal testing is critical when adding new sites, as it will examine which network resources are available and reveal the type of traffic passing between sites.



*  Deployment of new network infrastructure

Every new network infrastructure should be thoroughly tested to simulate the actions of a hacker. While an external test is generally performed (with little prior knowledge of the infrastructure) to ensure perimeter security, the internal testing should also be executed to ensure that network resources such as: servers, storage, routing and access devices are sufficiently hardened and that the infrastructure is secure from any attack, assuming that the perimeter is breached.



*  Changes/upgrade to existing infrastructure

Changes are inevitable -- be it software, hardware or network design, changes/upgrades are performed to either enhance the features; to fix critical bugs and/or to accommodate a new requirement. Whenever existing infrastructure is changed, it should be tested again to ensure that new vulnerabilities have not arisen. The amount of testing required will depend on the nature and level of the changes made to the infrastructure. While, minor changes such as configuration changes to a particular rule will only require a port scan to ensure the expected firewall behaviour, any major changes such as upgrades of critical equipment/OS version may require a full retest.



*  Rolling out a new application

Once the infrastructure has been thoroughly tested, the new applications (whether Internet facing or Intranet hosted) must also be tested for security blanket before they are put in production. This testing needs to be performed on a "real-life" platform, ensuring that the application only uses the defined ports and that the code itself is secure.



*  Changing/upgrading an existing application

As with infrastructure changes, application changes also vary in nature. Very minor changes such as user account changes will not require testing. However, major changes involving the functionality of the application should be thoroughly retested.



*  Periodic repeat testing

Managing security is not easy and companies should not consider a penetration test as the final remedy of all security problems. If a company considers it "so," they are falling for a false sense of security. It's always a good practice to perform periodic testing of sensitive systems to ensure that unscheduled changes have not been made.
Read more...

Why penetration testing?


Penetration testing is one of the oldest methods for assessing the security of a computer system. In the early 1970's, the Department of Defense used this method to demonstrate the security weaknesses in computer systems and to initiate the development of programs to create more secure systems.

Penetration testing is increasingly used by organizations to assure the security of Information systems and services, so that security weaknesses can be fixed before they get exposed.

The frequency and severity of network intrusion, data theft and attacks caused by malicious code, hackers, disgruntled employees continues to increase and the risks and costs associated with network security breaches and data theft are astronomical.

With every ebusiness initiative, the demand for secure, remote access to company networks is also increasing. The truth is, even well managed implementations, involving the latest hardware and software may be susceptible to misconfigurations or software flaws.

These may eventually give an intruder access to sensitive information. Using penetration testing tools can significantly reduce the risk of this occurring.



While the principal objective of penetration testing is to determine security weaknesses in an organization's network infrastructure; it can have number of secondary objectives, including testing the organization's security incidents identification and response capability, testing employee security awareness or testing security policy compliance.


Reasons to perform a network penetration test

• A penetration test helps organizations to understand their current security posture by identifying gaps in security. This enables organizations to develop an action plan to minimize the threat of attack or misuse.

• A well-documented penetration test result, helps managers in creating a strong business case to justify a needed increase in the security budget or make the security message heard at the executive level.

• Security is not a single point solution, but a process that requires due diligence. Security measures need to be examined on a regular basis to discover new threats. A penetration test and an unbiased security analysis enable organizations to focus internal security resources where they are needed most. In addition, the independent security audits are rapidly becoming a requirement for obtaining cyber-security insurance.

• Meeting regulatory and legislative requirements are a must for conducting businesses today. Penetration testing tools help organizations meet these regulatory compliances.

• One of the core objectives of an e-business initiative is to enable close working with strategic partners, suppliers, customers and others upon whom the ebusiness depends. To accomplish this goal, organizations sometimes allow partners, suppliers, B2B exchanges, customers and other trusted connections into their networks. A well executed penetration test and security audits help organizations find the weakest links in this complex structure and ensure that all connected entities have a standard baseline for security.

• Once security practices and infrastructure is in place, a penetration test provides critical validation feedback between business initiatives and a security framework that allows for successful implementation at minimal risk.



Read more...

• Provides a clear picture of current information security risks
• Identifies the potential impact of vulnerabilities on your network infrastructure
• Raises internal awareness of information security risks
• Help identify the gaps in organizational security controls, policies and processes
• Provides a specific, actionable plan to improve overall security posture based on your business needs
• Enables you to effectively address security issues before they are exploited
• Helps to meet regulatory compliance requirements

Read more...

A web application’s security assessment will allow us to analyze the critical components of a Web-based portal, e-commerce application, or Web platform.

Using manual techniques and hundreds of appropriate tools the assessment pinpoints specific vulnerabilities and identifies underlying problems. The analysis integrates detailed vulnerability and countermeasure information for:

• authentication
• authorization
• session management
• data integrity
• data confidentiality
• privacy concerns

Tranchulas provides comprehensive reviews for:

• Fundamental Design Security
• HTML Source Management
• General Input Validation
• SQL Injection
• Cross Site Scripting
• Token Analysis (Cookies, Custom Session IDs, etc.)
• Session Security (Authentication and Authorization)

The Most Common Application Layer Vulnerabilities are:


80%                    Cross-site scripting







Read more...

Internal on-site penetration testing gives the business the assurance it needs to perform tasks safely on the internet . Internal assessments use a similar methodology to an external assessment, however the engagement will occur from within the WAN at each logical management zone, physical segment or simply attached to the DMZ.



To attach to an internal network requires a significant depth of knowledge in many areas. These areas are not limited to Policy, Architecture, Implementation and Auditing across multiple business units, operating systems and devices. We at Tranchulas have all of these skill sets.



Our typical Onsite or Internal network penetration test would include internal network port and vulnerability scans, onsite visits, review of your network architecture, industry best practices, and an on-site meeting to discuss the findings and answer any questions you may have. The security consultant may spend up to 2 or 3 days onsite evaluating current policies, procedures, the state of physical and network security, and conducting interviews. Each audit is tailored to the customer. Tranchulas team will work in your organization with the same rights as one of the users and try to gain access to the systems that should not be available at the user's level of privileges. This test helps to establish how effectively your organization's security access controls are deployed.
Read more...

External or Remote Network Penetration testing


This test mainly focuses on publicly available network resources that expose you to a network compromise. The penetration test may be performed with non or full discovery of the environment in question. Our testing includes a detailed analysis of routers, firewalls, email servers and web applications. The engagement would start with publicly accessible information about the client, followed by network enumeration.



Network enumeration allows us to target hosts, and specific network security attacks. We would then assess the open ports, services and specific security vulnerabilities, and use that information to gain a foothold into the environment. After a foothold is established, escalation of privilege occurs until the external environment is controlled.
Read more...

What is Penetration Testing?


Penetration testing is a controlled and managed simulation of an actual system intrusion. It gives you a realistic experience of an attempted break-in into your information system. During a penetration test, your security mechanisms as well as your intrusion detection and response capabilities are put to the test against a skilled, motivated



attacker - only this time you have a complete insight in his thoughts and actions. This is a unique opportunity to get to know your enemy, without the damage you would sustain in a real attack.


Read more...