Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Hacking Yourself Pays Off In Tighter Security

Whether you build your own penetration test team or hire a third party, pen testing is a crucial for security.

The disclosure earlier this year of attacks originating in China and targeting Google and other large corporations proves that today's cybercriminals are sophisticated and out for financial gain, not bragging rights. These targeted, multipronged intrusions draw on a range of techniques and tools, including exploitable vulnerabilities, inside information, and attackers' sheer persistence. Could your systems stand up to these sophisticated threats? For many enterprises, the best way to find out is to attack yourself first, or hire somebody to do so. A good penetration test may spot security vulnerabilities before attackers do.

The issue is that our standard security product lineup focuses on the Internet as an attack vector, but that's not the only way in. A determined attacker can break in by gaining the cooperation of an insider or even through physical access to your buildings. To really test your defenses, you need to attempt penetration via all of these methods.

In the past, penetration test customers were typically limited to institutions, such as banks and government agencies, that had both large amounts of sensitive data and the resources to fund specialized tests. These days, there's a greater awareness of and interest in penetration testing. Some companies use internal assets, others bring in an outsider to rattle IT's cages.

"The two main drivers behind penetration testing achieving more mainstream recognition are the PCI Data Security Standards and boardroom attention," says Nick Selby, managing director of Trident Risk Management, a security consulting firm that conducts assessments. Other compliance standards, such as HIPAA, also carry pen test requirements. Penetration tests conducted by third parties are the norm, but there is a do-it-yourself option thanks to automated pen testing products from vendors such as Core Security Technologies, Immunity, and Rapid7. Open source tools are also available for companies that want to build their own pen test kits.

The Human Factor

A true penetration test involves far more than a scan and a report. Steve Stasiukonis, VP of Secure Network Technologies and a pen tester for more than a decade, says scannable network components are only one of three elements that must be evaluated.

"People, process, and technology are all part of a thorough test," Stasiukonis says. "Of the three, people are the weakest link, and a good pen tester will perform reconnaissance that determines what's needed to get past your people and into your systems."

We all know that employees with weak passwords are weak links. But there's much more to social engineering, in which the attacker gains a target's trust, which can then be exploited. Social engineering attacks are often used to gain physical access to a building or sensitive location. For instance, Stasiukonis and his colleagues will disguise themselves as service technicians--complete with uniforms and logo-emblazoned van--to gain physical entry into a client's business.

A variation of this attack is security blogger Scott Wright's Honeystick Project, in which Wright left USB flash drives loaded with harmless notification and logging software in public places. According to Wright, 65% of those drives were picked up by people who then connected them to their computers.

Testing the "human factor" not only helps organizations identify specific personnel-based risks but may also illuminate gaps in organizational understanding of security issues.

"Penetration test results should raise internal awareness issues," Selby says. For example, one result of a social engineering attack could be that the organization conducts awareness training for executives about the ways in which they may be targeted, such as by spear phishing, an attack in which malware-loaded e-mails that appear to come from a reliable source are sent to specific, high-value targets, such as corporate executives.

Insource, Outsource, Or Both?

Some companies may decide to add pen testing specialists to their IT departments, or to designate existing IT staff members as pen testers, often equipping them with automated pen testing tools that make it easier for an in-house team to conduct assessments.

The characteristics of an internal pen test team are nearly as varied as the number of companies that have them. Large banks and manufacturers may have a dozen full-time employees assigned to vulnerability assessment and penetration testing, while at smaller companies, pen testing may be just one part of an infosec pro's job.

An internal team has several advantages. For one, companies can run pen tests more frequently, which may be useful to address compliance requirements, or to test the organization's susceptibility to a new vulnerability or attack method. In addition, an internal team will likely also have more detailed knowledge of the business than an outside consultant. This knowledge can be helpful because the team can translate the results of the test into meaningful actions that will help reduce the company's risk.

If you don't have an internal team, you will have to get budget authorization to hire a consultant. Aside from the cost, hiring a third-party team can be time consuming because you have to carefully vet the provider and then schedule the test.

But does having an internal pen testing group (sometimes known as a "red team") eliminate the need for external testing? Not necessarily.

An external pen test still has its advantages. For one, an outsider has the advantage of anonymity, which is particularly important for social engineering attacks. For another, an outsider brings fresh eyes to an organization and may consider avenues of attack that an internal team wouldn't.

White Hats, Black Hats

What sort of person makes a good pen tester? Penetration testing is often referred to as "ethical hacking" to distinguish it from criminal intrusions. Pen testers can even achieve certification as an ethical hacker from the International Council of Electronic Commerce Consultants.

It's not unusual for a skilled black hat to go legit after a few run-ins with the law and offer services to corporations as a pen tester.

But should you hire a pen tester who's been convicted of cybercrime?

"Absolutely not," says Stasiukonis, who considers it unwise to add a convicted felon to the security team, even one who claims to have reformed. Whether you agree or not, if you plan to hire a penetration testing consultant or build a team, expect to perform thorough background and reference checks--as thorough as you would for any IT professional who gets privileged access to sensitive data and computer systems.

Good penetration testing professionals have more than just the ability to break things, Stasiukonis says. "If I were looking to hire a penetration tester, I'd be watching for someone with a variety of skill sets, not just technical capabilities," he says. "You want a renaissance person, someone who sees more than one view of an issue."

It's also important to know the candidate's level of expertise, whether for an internal pen testing position or for a consulting engagement. And penetration testers must be able to analyze the results of their efforts, then communicate that analysis to a variety of audiences, including technical peers and executives. Thus, presentation and communication skills are an important consideration.

Penetration tests play an important role in a company's overall security strategy. By learning to view an enterprise as attackers view it--and by sharing test results and security awareness across all silos--companies can get a unique snapshot of the risks their organizations face. It's one thing to have security policies and tools in place. When it comes to an actual intrusion attempt, a penetration test can tell you whether your security practices make the grade.

Keith Ferrell writes about information security and other technology subjects. Write to us at [email protected]

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
How Enterprises Are Assessing Cybersecurity Risk in Today's Environment
The adoption of cloud services spurred by the COVID-19 pandemic has resulted in pressure on cyber-risk professionals to focus on vulnerabilities and new exposures that stem from pandemic-driven changes. Many cybersecurity pros expect fundamental, long-term changes to their organization's computing and data security due to the shift to more remote work and accelerated cloud adoption. Download this report from Dark Reading to learn more about their challenges and concerns.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2022-01-19
Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter. SQL injection vulnerability via taocms\include\Model\Article.php.
PUBLISHED: 2022-01-19
Cross-site Scripting (XSS) - Stored in NPM cypress-orchardcore prior to 1.2.2.
PUBLISHED: 2022-01-19
libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of incorrect sprintf usage in SPF_record_expand_data in spf_expand...
PUBLISHED: 2022-01-19
libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of SPF_record_expand_data in spf_expand.c. The amount of overflowed data dep...
PUBLISHED: 2022-01-19
A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed.