Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/23/2013
05:00 PM
Vincent Liu
Vincent Liu
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Beware Of The 'Checklist' Penetration Tester

A surefire way to spot a novice

Part 2 in a series on spotting a novice pen tester

If your penetration tester has an overreliance on checklists, then he or she is a novice. In the hands of a novice tester, checklists are treated as both the start and the end of a test.

In the eyes of a skilled tester, a checklist defines the minimum level of testing. A common mistake made when evaluating third-party firms is to place too much weight on checklist comparisons. Sure, it's easy to compare lists, but it often leads to the omission and exclusion of much more important attributes, such as whether they can actually hack.

Consider this: You aren't feeling well, so you go to see the doctor. Your doctor follows a top 10 checklist to try and diagnose your symptoms, but none of the symptoms matched. So you're sent home with a clean bill of health because none of your problems were on the top 10 checklist. You're probably thinking that this doctor should have his medical license reviewed, but this is how many novice pen testers go about performing their assessments -- by adhering strictly to a checklist.

If you notice that the only issues being identified are the ones commonly found on a top 10 (e.g., OWASP Top 10) list, then there's a chance that those are the only ones that are being tested. Going off of a checklist can garner only so many results or findings, and oftentimes validating a finding is confused with actually performing a penetration test -- and it really is not the same. It's important to note that checklists can be helpful, but checklist-driven testing should not be the end-all, be-all when it comes to penetration testing because you can't find what you're not looking for.

It's good to ask your tester what he attempted to look for but didn't find. If you're still suspicious, then ask for evidence. A similar question to ask is: What aspects of security were strong? Carefully listen to his response because the answer should not be a statement of what you don't have (e.g., you didn't have SQL injection), but instead a statement of you do have (e.g., your input validation system is effective at stopping input-based attacks).

Part one of this series is here.

Vincent Liu (CISSP) is a Partner at Bishop Fox, a cyber security consulting firm providing services to the Fortune 500, global financial institutions, and high-tech startups. In this role, he oversees firm management, client matters, and strategy consulting. Vincent is a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22677
PUBLISHED: 2021-05-07
An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues such as a denial-of-service condition or code execution on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4....
CVE-2021-29495
PUBLISHED: 2021-05-07
Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to receive a patch or, as a workaround, set "verifyMode = CVerifyPeer" as documente...
CVE-2020-4901
PUBLISHED: 2021-05-07
IBM Robotic Process Automation with Automation Anywhere 11.0 could allow an attacker on the network to obtain sensitive information or cause a denial of service through username enumeration. IBM X-Force ID: 190992.
CVE-2021-21419
PUBLISHED: 2021-05-07
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reas...
CVE-2021-27437
PUBLISHED: 2021-05-07
The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and password that can be used to query Grafana APIs. Authentication is not required for exploitation on the WISE-PaaS/RMM (versions prior to 9.0...