Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/18/2009
06:07 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Penetration Testing Grows Up

Metasploit's expected entry into the commercial penetration testing market is the latest step toward making pen testing more mainstream

Penetration testing, once considered a risky practice for the enterprise and even a tool for evil hacking purposes, is becoming more of an accepted mainstream process in the enterprise mainly due to compliance requirements, more automated, user-friendly tools -- and most recently, the imminent arrival of a commercial offering based on the popular open-source Metasploit tool.

Rapid7's purchase of the Metasploit Project last month and its hiring of the renowned creator of Metasploit, HD Moore, demonstrate just how far penetration testing has come during the past 18 months, security analysts say. While some organizations still confuse penetration testing with the more pervasive vulnerability scanning, which searches for and pinpoints specific vulnerabilities and weaknesses, penetration testing is finally about to enter a new phase of commercial deployment, experts say.

Penetration testing basically puts the tester in the shoes of a would-be attacker, using exploits and attack combinations against a network or application to find where the actual exploitable weaknesses lay.

"This is an exciting time because we're starting see even the edgy [penetration testing providers] look to the enterprise as a viable market," says Nick Selby, managing director of Trident Risk Management, a Dallas-based security and consultancy firm. "The technology is more mature so that the more experienced and skilled penetration testers have better toolsets than ever...and the less experienced ones can do more of the low-hanging fruit work."

Penetration testing traditionally has been the domain of white hat hackers, as well as script kiddies and even black-hat types. But as leading penetration testing vendors Core Security Technologies and Immunity Inc. have struck partnerships with top vulnerability scanning vendors and worked on developing more user-friendly versions of their tools, pen testing has begun to gain broader appeal within the enterprise. Core has partnerships with eEye, GFI, IBM, Lumension, nCircle, Qualys, and Tenable, while Immunity is teamed up with Tenable, as well, for instance.

"Pen testing has been a bit too edgy up until now to fully integrate with the more safe and steady-as-she-goes vulnerability assessment scanning," Selby says. "But that's changing: Over the coming year, we'll see better integration with the existing partnerships Core and Immunity have. And with the rapid integration of Rapid7 and Metasploit, vulnerability assessment and penetration testing will become better defined in the minds of run-of-the-mill security specialists and managers."

Rapid7 has said it plans to enhance its NeXpose vulnerability management products, as well as its penetration testing services, with Metasploit technology. Although Rapid7 is still looking at just how it will combine these technologies, the company is considering keeping Metasploit a separate product that's heavily integrated with its existing vulnerability scanning product and pen-testing services.

Corey Thomas, vice president of products and operations at Rapid7, said recently the goal is for Metasploit's exploit technology to help determine which vulnerabilities found by NeXpose are exploitable.

Rapid7's Moore, who is the chief security officer there, says the old worries of a pen test knocking a server or service offline have been superseded by bigger concerns of what an attacker could do. The risk of an attacker doing serious damage has more enterprises starting to use pen-testing tools, or to hire out pen-testers. "If you have let the malware in, you might as well let the pen tester in," Moore says.

Meanwhile, even the profile of today's pen tester is changing -- albeit less rapidly -- as well. Traditionally the domain of security specialists and hackers, pen-testing duties are starting to fall to others in the enterprise as well.

Ivan Arce, CTO of Core, says when Core first started out, it was an internal security expert or outside consultant who used its tools. "It was a more technical person with knowledge about exploits and attacks and who could manually choose actions one by one," Arce says. "Over time as we've added automation and ease of use, the barrier to entry was lowered. Today, it's not [always] necessarily a pen tester" using the tools, he says. It's a network security professional, a vulnerability specialist, a Web security specialist, a security user, an auditor, or a developer. "I see that trend expanding and increasing in the future," he says.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4245
PUBLISHED: 2019-12-11
Orca has arbitrary code execution due to insecure Python module load
CVE-2013-4593
PUBLISHED: 2019-12-11
RubyGem omniauth-facebook has an access token security vulnerability
CVE-2013-6495
PUBLISHED: 2019-12-11
JBossWeb Bayeux has reflected XSS
CVE-2013-7370
PUBLISHED: 2019-12-11
node-connect before 2.8.2 has cross site scripting in methodOverride Middleware
CVE-2019-18935
PUBLISHED: 2019-12-11
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote cod...