Assessing a pen tester: Making the right choice when choosing a third party Pen Test Firm

Tom Eston, CISSP, GWAPT

Jason Broz, CIPP/US

Assessing a Pen tester:

Making the right choice when selecting a third party firm

2/12/2014

PRESENTATION

Data Classification: SecureState Proprietary

WEBINAR PRESENTERS

• Jason Broz, CIPP/US• Audit and Compliance Consultant• Previous Positions include

• IT for a Fortune 1000 company• Management and Sales

• Member of IAPP and ISACA

2

• Tom Eston, CISSP, GWAPT• Manager, Attack and Defense Team• Founder SocialMediaSecurity.com• OWASP Contributor• SANS Community Instructor• International Speaker

• DEFCON, Black Hat USA/Abu Dhabi and many others

Data Classification: SecureState Proprietary

WEBINAR GOALS

• Help you better understand Penetration Testing goals and objectives

3

• Provide clarity on differences

• Elaborate upon differences within the industry

• Answer questions in regard to decision making

Data Classification: SecureState Proprietary

QUICK POLL

• Who has recommended a pentest?• Who has purchased a pentest?• Who has performed a pentest?• Who has had to deal with the results

from a pentest? – Who has seen bad report?

4

Data Classification: SecureState Proprietary

WHAT IS A PENETRATION TEST?

5

Data Classification: SecureState Proprietary

WHAT IS PENETRATION TESTING?

“Penetration testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network. It often involves launching real attacks on real systems and data that use tools and techniques commonly used by attackers”

~NIST 800-115, http://csrc.nist.gov/publications/nistpubs/800-115/SP800-115.pdf

6

• Method of evaluating the security of:o Computer systemso Network Deviceso Web Applicationso Physical Buildings and

Infrastructure• Simulates an intrusive attack by a

malicious attacker

Data Classification: SecureState Proprietary

KEY COMPONENTS OF PENETRATION TESTING

• Established methodology• Attack Vectors• Scope established• Trophies or Goals identified• Manual methods used in addition to

tools• Team based

7

Data Classification: SecureState Proprietary

MOST COMMON PENETRATION TESTING

METHODOLOGIES• Penetration Testing firms should follow

one or more of the following methodologies:• PTES (Penetration Testing Execution

Standard)• NIST 800-115• OSSTMM (Open Source Security Testing

Methodology Manual)• OWASP Testing Guide (Open Web

Application Security Project)

8

Data Classification: SecureState Proprietary

PENETRATION TESTS ARE NOT

• Vulnerability Assessments• Simply running an automated tool (e.g., Nessus)

• Manual review of security “controls”• This is an Audit

From a cost perspective, a pentest will cost significantly more than a Vulnerability Assessment because of the manual testing

involved.

9

Data Classification: SecureState Proprietary

• Compliance requirement (PCI)• Told to perform a Penetration Test by

management• Identification of vulnerabilities in your

network that can be exploited• How difficult would it be for a hacker to

compromise valuable data?• Are your defenses working? Test of Incident

Response and Monitoring systems.• Need budget to resolve issues and build the

security program

REASONS FOR PERFORMING A

PENETRATION TEST

10

Data Classification: SecureState Proprietary

• Consumes your entire security budget • Lack of resources to address any issues

that the penetration test might discover• No clear goals defined for the pentest

A penetration test is an excellent way to identify problems, but on its own it cannot fix them.

REASONS NOT TO PERFORM A

PENETRATION TEST

11

Data Classification: SecureState Proprietary

• Incident Response• Is someone monitoring your assets? • How do they respond?

• Security Awareness of Users• Social Engineering• Phishing, Phone Calls

• Alarms, Guards, and Detection• Are physical controls sufficient?

12

SECONDARY BENEFITS

Data Classification: SecureState Proprietary

WHAT DOES ALL THIS MEAN TO YOU?

13

Data Classification: SecureState Proprietary

PENETRATION TESTS WITHIN YOUR

ORGANIZATION• Does your organization need a Penetration Test?

• Why does your organization need to do a Penetration Test?

• What type of Penetration Test do you need?

• What are your goals?• What is the objective?• What is the most valuable data on your

network?• Trophies

14

Data Classification: SecureState Proprietary

WHY DOES YOUR ORGANIZATION NEED A

PENETRATION TEST?• Do you have sensitive data?• Credit Card Numbers• Protected Health Information (PHI)• Personally Identifiable Information (PII)• Proprietary Data

• Regulatory requirement? • Payment Card Industry (PCI or HIPAA)

• Unsure of your defenses?• Need to obtain budget?

15

Data Classification: SecureState Proprietary

WHAT TYPE OF PENETRATION TEST DO

YOU NEED? • Several different types:• External Network• Social Engineering• Internal Network• Wireless Network• Web Application• Physical Security• Full Scope

16

Data Classification: SecureState Proprietary

• Simulates a attacker on the Internet• Passive footprinting• What network ports are exposed?• This type of penetration test should

include brute force attacks

• Most common type of penetration test

• Typically done remotely

EXTERNAL NETWORK

17

Data Classification: SecureState Proprietary

• Targets people, processes and awareness• Phishing• Spear Phishing• Phone Calls• USB/Thumb Drive Drops

• Often paired with other assessments

SOCIAL ENGINEERING

Social Engineering attacks typically have a VERY high success rate.

18

Data Classification: SecureState Proprietary

• Simulates someone gaining access to your internal network• Contractor, malicious employee,

backdoor malware

• What internal resources can we penetrate?• Critical servers, PCI data, etc.

• Can be paired with wireless and physical assessments

19

INTERNAL NETWORK

Data Classification: SecureState Proprietary

• Focused on attacking wireless networks

• Tests encryption strength, authentication

• How far can someone see the wireless network?• Can someone connect from a far

distance?

• War Driving

20

WIRELESS NETWORK

Data Classification: SecureState Proprietary

• Three types of Web Application Penetration Tests• Black Box• No previous knowledge

• Grey Box• User credentials provided, user role and

business logic testing

• White Box• Code review

21

WEB APPLICATION

Data Classification: SecureState Proprietary

• Assess the physical security of a facility or location• Human Safety• Confidentiality• Integrity• Availability

• How can someone access your facility?• Tailgating, lock picking, alarm bypass• Social engineering

22

PHYSICAL SECURITY

Data Classification: SecureState Proprietary

• A good Penetration Test should focus on attacking the core business and its processes

• Need to understand how sensitive data traverses your network• What it touches• Where it is stored• How it is transmitted

• Are there other things that you would like to assess? • Secondary considerations

23

DETERMINING SCOPE

Data Classification: SecureState Proprietary

• Regulatory Requirements• PCI requires all systems on a segment to be

tested

• Don’t lose value in what you purchased!• Limiting scope • Determine Trophies

24

DETERMINING SCOPE

Data Classification: SecureState Proprietary

• Define operational restraints • Assessment timeframe

• Outside of business hours• During business hours

• Need to know• Test of Incident Response• Notify only those with a business need• Penetration Testing firm needs to provide IP

addresses and contact information of the consultant performing the engagement!

• Ask for a Project Charter

OTHER SCOPE CONSIDERATIONS

25

Data Classification: SecureState Proprietary

WHAT DO YOU DO NOW?

26

Data Classification: SecureState Proprietary

WHAT TO LOOK FOR WHEN OBTAINING A THIRD PARTY FIRM

• Methodology• Tools• Goals• Results• Experience• Certifications

27

Data Classification: SecureState Proprietary

METHODOLOGY

• A penetration test methodology needs to follow:• Reconnaissance • Enumeration • Exploitation • Post Exploitation• Pilfering• Clean up and Reporting

28

Data Classification: SecureState Proprietary

METHODOLOGY

• Reconnaissance • Initial information gathering• Non-invasive• Goal is to learn everything you can about the

target

• Enumeration • Potential vulnerabilities are initially identified• Can involve the use of vulnerability scanners• Also involves manual interaction

29

Data Classification: SecureState Proprietary

METHODOLOGY

• Exploitation• Attempt to exploit vulnerabilities • Tools like Metasploit, Core Impact could be

used• Typically involves manual work including

developing custom exploit code

• Post Exploitation • Attempt to leverage exploited vulnerabilities• Elevating privileges on compromised systems• Potential for leveraging trust relationships

between systems

30

Data Classification: SecureState Proprietary

METHODOLOGY

• Pilfering• Attempt to obtain “trophies” and other

sensitive data• Defined in the scope• Penetration testers use password hashes,

encryption keys and user lists to gain access to data (to name a few)

• Clean up and Reporting• The penetration tester should always clean up

after themselves!• Remove files left by the tester, traces of

access• Reporting is the most important phase!

31

Data Classification: SecureState Proprietary

• They only plan to use a vulnerability scanner such as Nessus

• They only plan to use a commercial exploitation tool such as Core Impact or Canvas

• The report is raw output from any of these tools

WARNING SIGNS

32

33Data Classification: SecureState Proprietary

• Limiting the scope of the test• Making changes while the test is being

performed• Using under-skilled penetration testers• Calling a Vulnerability Scan a Penetration

Test

COMMON MISTAKES IN PENETRATION TESTS

Data Classification: SecureState Proprietary

• A common misconception is that a pentest is nothing more than running the Nessus scanner

• A vulnerability scanner casts a very wide net, and makes a lot of noise

• Penetration tests are focused, and often quiet

• Many penetration testers don’t use a vulnerability scanner at all during their testing

VULNERABILITY SCANNERS

34

Data Classification: SecureState Proprietary

• Does not identify dangerous trust relationships between components

• Vulnerability scans contain false positives• Not an accurate picture of security• If PCI is a concern, both pentesting and

Vulnerability Scans are needed for a Report on Compliance

• Attackers will take advantage of chained vulnerabilities to obtain access• Vulnerability Linkage

35

WHY A VULNERABILITY SCANNER IS NOT

ENOUGH

Data Classification: SecureState Proprietary

• It’s not uncommon for several lower severity vulnerabilities to be chained together to allow an attacker to compromise something of high value

• Demonstrating where this can be done is one of the most valuable things a pentest can provide you

• The Penetration Testing firm needs to provide detailed explanation of any of these situations

CHAINED VULNERABILITIES

36

Data Classification: SecureState Proprietary

• Covers all relevant attack vectors not defined by IP ranges

• Should be goal based• Clearly shows vulnerable assets that can

be compromised• Tests the system as a whole, including

existing defense mechanisms• Your goals and objectives• Definitive end to the project

WHAT IS A “GOOD”PENETRATION TEST

37

Data Classification: SecureState Proprietary

• Output typically includes some kind of report• Should not only be raw data or tool report• Discusses high level and detailed findings

• Needs an Executive Summary!

• Ask for information on all of the vulnerabilities that were found

• If the penetration tester got to a trophy, you want to know exactly how they got there. • Usually a chain of several vulnerabilities

• Penetration Tester should provide screen shots, tool logs and other data upon request

RESULTS

38

Data Classification: SecureState Proprietary

• After the Penetration Test has been completed, the organization will have a better understanding of the areas that need to be hardened within the infrastructure

• Mitigate the high risk vulnerabilities to lower your chances of a breach

• Follow security principles (defense in depth) to improve security after remediation

39

RESULTS: NEXT STEPS

Data Classification: SecureState Proprietary

• Assessing the skills and experience of a penetration testing firm can be difficult, a few items to look for:• How long have they been doing penetration

testing?• Have they written any pentesting tools?• Have they presented on pentesting at large

pentest events (SANS, DEFCON, Shmoocon, BlackHat, DerbyCon)?

• Do they have any pentest certifications (OSCP, GPEN, GWAPT)?• Some certifications like CEH are less credible!

EXPERIENCE

40

Data Classification: SecureState Proprietary

• OSCP (Offensive Security Certified Professional) • Most technical, most challenging penetration

testing certification

• SANS GPEN (GIAC Certified Penetration Tester) • Covers methodology and reporting in addition

to hands on technical skills

CERTIFICATIONS

41

Data Classification: SecureState Proprietary

• SANS GWAPT (GIAC Web Application Penetration Tester) • Similar to GPEN, but focuses on web apps

• Social-Engineer, Inc. – Social Engineering Pentest Professional (SEPP)• Up and coming certification for Social

Engineering, highly respected in the security community

CERTIFICATIONS

42

Data Classification: SecureState Proprietary

• CISSP, CISA, CCIE Security, Security+, or the many other SANS certs are helpful

• However, these other certifications are not meant to certify the individual as a penetration tester

You don’t hire an OSCP to do a PCI audit, and you don’t hire a QSA to do a pentest

CERTIFICATIONS

43

Data Classification: SecureState Proprietary

PCI CONSIDERATIONS

• PCI DSS 3.0 is modifying requirements for Penetration Testing• Verification of methodology based on industry

accepted best practices• Validates segmentation and scope reduction

controls• Includes review and consideration of threats

and vulnerabilities experienced in the last 12 months

• Specifies retention of penetration testing results and remediation activities results

• Vulnerabilities are corrected and testing repeated

44

Data Classification: SecureState Proprietary

• We have provided a worksheet which covers some of the criteria discussed

• Feel free to use this when you find yourself dealing with penetration testers and firms that offer penetration testing

• A copy can be found online as well at http://engage.securestate.com/pentest-assessment-worksheet

WORKSHEET

45

Data Classification: SecureState Proprietary

QUESTIONS?

46

Data Classification: SecureState Proprietary

CONTACT INFO

Thank you for your time!

Tom Eston- teston@securestate.comTwitter: agent0x0

Jason Broz- jbroz@securestate.comTwitter: jbroz67

47