Vulnerabilities / Threats
5/23/2013
05:00 PM
Vincent Liu
Vincent Liu
Commentary
50%
50%

Beware Of The 'Checklist' Penetration Tester

A surefire way to spot a novice

Part 2 in a series on spotting a novice pen tester

If your penetration tester has an overreliance on checklists, then he or she is a novice. In the hands of a novice tester, checklists are treated as both the start and the end of a test.

In the eyes of a skilled tester, a checklist defines the minimum level of testing. A common mistake made when evaluating third-party firms is to place too much weight on checklist comparisons. Sure, it's easy to compare lists, but it often leads to the omission and exclusion of much more important attributes, such as whether they can actually hack.

Consider this: You aren't feeling well, so you go to see the doctor. Your doctor follows a top 10 checklist to try and diagnose your symptoms, but none of the symptoms matched. So you're sent home with a clean bill of health because none of your problems were on the top 10 checklist. You're probably thinking that this doctor should have his medical license reviewed, but this is how many novice pen testers go about performing their assessments -- by adhering strictly to a checklist.

If you notice that the only issues being identified are the ones commonly found on a top 10 (e.g., OWASP Top 10) list, then there's a chance that those are the only ones that are being tested. Going off of a checklist can garner only so many results or findings, and oftentimes validating a finding is confused with actually performing a penetration test -- and it really is not the same. It's important to note that checklists can be helpful, but checklist-driven testing should not be the end-all, be-all when it comes to penetration testing because you can't find what you're not looking for.

It's good to ask your tester what he attempted to look for but didn't find. If you're still suspicious, then ask for evidence. A similar question to ask is: What aspects of security were strong? Carefully listen to his response because the answer should not be a statement of what you don't have (e.g., you didn't have SQL injection), but instead a statement of you do have (e.g., your input validation system is effective at stopping input-based attacks).

Part one of this series is here.

Vincent Liu (CISSP) is a Managing Partner at Stach & Liu, a security consulting firm providing services to the Fortune 500, global financial institutions, and high-tech startups. In this role, he oversees firm strategy, practice development, and client matters. Vincent is ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-0658
Published: 2015-03-27
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.