Vulnerabilities / Threats
5/23/2013
05:00 PM
Vincent Liu
Vincent Liu
Commentary
50%
50%

Beware Of The 'Checklist' Penetration Tester

A surefire way to spot a novice

Part 2 in a series on spotting a novice pen tester

If your penetration tester has an overreliance on checklists, then he or she is a novice. In the hands of a novice tester, checklists are treated as both the start and the end of a test.

In the eyes of a skilled tester, a checklist defines the minimum level of testing. A common mistake made when evaluating third-party firms is to place too much weight on checklist comparisons. Sure, it's easy to compare lists, but it often leads to the omission and exclusion of much more important attributes, such as whether they can actually hack.

Consider this: You aren't feeling well, so you go to see the doctor. Your doctor follows a top 10 checklist to try and diagnose your symptoms, but none of the symptoms matched. So you're sent home with a clean bill of health because none of your problems were on the top 10 checklist. You're probably thinking that this doctor should have his medical license reviewed, but this is how many novice pen testers go about performing their assessments -- by adhering strictly to a checklist.

If you notice that the only issues being identified are the ones commonly found on a top 10 (e.g., OWASP Top 10) list, then there's a chance that those are the only ones that are being tested. Going off of a checklist can garner only so many results or findings, and oftentimes validating a finding is confused with actually performing a penetration test -- and it really is not the same. It's important to note that checklists can be helpful, but checklist-driven testing should not be the end-all, be-all when it comes to penetration testing because you can't find what you're not looking for.

It's good to ask your tester what he attempted to look for but didn't find. If you're still suspicious, then ask for evidence. A similar question to ask is: What aspects of security were strong? Carefully listen to his response because the answer should not be a statement of what you don't have (e.g., you didn't have SQL injection), but instead a statement of you do have (e.g., your input validation system is effective at stopping input-based attacks).

Part one of this series is here.

Vincent Liu (CISSP) is a Managing Partner at Stach & Liu, a security consulting firm providing services to the Fortune 500, global financial institutions, and high-tech startups. In this role, he oversees firm strategy, practice development, and client matters. Vincent is ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8893
Published: 2015-01-28
Multiple cross-site scripting (XSS) vulnerabilities in (1) mainpage.jsp and (2) GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-8894
Published: 2015-01-28
Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter.

CVE-2014-8895
Published: 2015-01-28
IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote attackers to bypass intended access restrictions and read the image files of arbitrary users via a crafted URL.

CVE-2014-8917
Published: 2015-01-28
Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media A...

CVE-2014-8920
Published: 2015-01-28
Buffer overflow in the Data Transfer Program in IBM i Access 5770-XE1 5R4, 6.1, and 7.1 on Windows allows local users to gain privileges via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If youíre a security professional, youíve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.