Go Hack Yourself

Penetration tests are crucial for your security operations

The disclosure earlier this year of attacks originating in China and targeting Google and other large corporations proves that today's cybercriminals are sophisticated and out for financial gain, not bragging rights. These targeted, multipronged intrusions draw on a range of techniques and tools, including exploitable vulnerabilities, inside information, and attackers' sheer persistence. Could your systems stand up to these sophisticated threats? For many enterprises, the best way to find out is to attack yourself first, or hire somebody to do so. A good penetration test may spot security vulnerabilities before attackers do.

The issue is that our standard security product lineup focuses on the Internet as an attack vector, but that's not the only way in. A determined attacker can break in by gaining the cooperation of an insider or even through physical access to your buildings. To really test your defenses, you need to attempt penetration via all of these methods.

In the past, penetration test customers were typically limited to institutions, such as banks and government agencies, that had both large amounts of sensitive data and the resources to fund specialized tests. These days, there's a greater awareness of and interest in penetration testing. Some companies use internal assets, others bring in an outsider to rattle IT's cages.

"The two main drivers behind penetration testing achieving more mainstream recognition are the PCI Data Security Standards and boardroom attention," says Nick Selby, managing director of Trident Risk Management, a security consulting firm that conducts assessments. Other compliance standards, such as HIPAA, also carry pen test requirements. Penetration tests conducted by third parties are the norm, but there is a do-it-yourself option thanks to automated pen testing products from vendors such as Core Security Technologies, Immunity, and Rapid7. Open source tools are also available for companies that want to build their own pen test kits.

The Human Factor

A true penetration test involves far more than a scan and a report. Steve Stasiukonis, VP of Secure Network Technologies and a pen tester for more than a decade, says scannable network components are only one of three elements that must be evaluated.

"People, process, and technology are all part of a thorough test," Stasiukonis says. "Of the three, people are the weakest link, and a good pen tester will perform reconnaissance that determines what's needed to get past your people and into your systems."

We all know that employees with weak passwords are weak links. But there's much more to social engineering, in which the attacker gains a target's trust, which can then be exploited. Social engineering attacks are often used to gain physical access to a building or sensitive location. For instance, Stasiukonis and his colleagues will disguise themselves as service technicians-complete with uniforms and logo-emblazoned van-to gain physical entry into a client's business.

A variation of this attack is security blogger Scott Wright's Honeystick Project, in which Wright left USB flash drives loaded with harmless notification and logging software in public places. According to Wright, 65% of those drives were picked up by people who then connected them to their computers.

Testing the "human factor" not only helps organizations identify specific personnel-based risks but may also illuminate gaps in organizational understanding of security issues.

"Penetration test results should raise internal awareness issues," Selby says. For example, one result of a social engineering attack could be that the organization conducts awareness training for executives about the ways in which they may be targeted, such as by spear phishing, an attack in which malware-loaded e-mails that appear to come from a reliable source are sent to specific, high-value targets, such as corporate executives.

Insource, Outsource, Or Both?

Some companies may decide to add pen testing specialists to their IT departments, or to designate existing IT staff members as pen testers, often equipping them with automated pen testing tools that make it easier for an in-house team to conduct assessments.

The characteristics of an internal pen test team are nearly as varied as the number of companies that have them. Large banks and manufacturers may have a dozen full-time employees assigned to vulnerability assessment and penetration testing, while at smaller companies, pen testing may be just one part of an infosec pro's job.

An internal team has several advantages. For one, companies can run pen tests more frequently, which may be useful to address compliance requirements, or to test the organization's susceptibility to a new vulnerability or attack method. In addition, an internal team will likely also have more detailed knowledge of the business than an outside consultant. This knowledge can be helpful because the team can translate the results of the test into meaningful actions that will help reduce the company's risk.

If you don't have an internal team, you will have to get budget authorization to hire a consultant. Aside from the cost, hiring a third-party team can be time consuming because you have to carefully vet the provider and then schedule the test.

But does having an internal pen testing group (sometimes known as a "red team") eliminate the need for external testing? Not necessarily.

An external pen test still has its advantages. For one, an outsider has the advantage of anonymity, which is particularly important for social engineering attacks. For another, an outsider brings fresh eyes to an organization and may consider avenues of attack that an internal team wouldn't.

White Hats, Black Hats

What sort of person makes a good pen tester? Penetration testing is often referred to as "ethical hacking" to distinguish it from criminal intrusions. Pen testers can even achieve certification as an ethical hacker from the International Council of Electronic Commerce Consultants.

It's not unusual for a skilled black hat to go legit after a few run-ins with the law and offer services to corporations as a pen tester.

But should you hire a pen tester who's been convicted of cybercrime?

"Absolutely not," says Stasiukonis, who considers it unwise to add a convicted felon to the security team, even one who claims to have reformed. Whether you agree or not, if you plan to hire a penetration testing consultant or build a team, expect to perform thorough background and reference checks-as thorough as you would for any IT professional who gets privileged access to sensitive data and computer systems.

Good penetration testing professionals have more than just the ability to break things, Stasiukonis says. "If I were looking to hire a penetration tester, I'd be watching for someone with a variety of skill sets, not just technical capabilities," he says. "You want a renaissance person, someone who sees more than one view of an issue."

It's also important to know the candidate's level of expertise, whether for an internal pen testing position or for a consulting engagement. And penetration testers must be able to analyze the results of their efforts, then communicate that analysis to a variety of audiences, including technical peers and executives. Thus, presentation and communication skills are an important consideration.

Penetration tests play an important role in a company's overall security strategy. By learning to view an enterprise as attackers view it-and by sharing test results and security awareness across all silos-companies can get a unique snapshot of the risks their organizations face. It's one thing to have security policies and tools in place. When it comes to an actual intrusion attempt, a penetration test can tell you whether your security practices make the grade.

Outsource Pen Testing Or Do It Yourself?

Case For Outsourcing

- Consultants will likely have more experience than a team you build yourself

- They'll have specialized knowledge, skills, and access to tools

- Consultants can remain anonymous within your company

- Most penetration engagements are priced in advance, so they're a fixed expense

- They're less of a drain on internal IT security resources (until it's time for remediation)

Case For DIY

- Tests are less expensive if done frequently

- Internal staff can put findings in context for your company's specific security and business risks

- Automated tools are available

- Staff can provide rapid response to new threats, infrastructure changes, and compliance regulations

- Staff is always on call

5 Things To Look For In A Pen Tester

1. Background and references: Check any pen tester as thoroughly as you'd check a new hire with administrative or password privileges

2. Professional experience and training: Look for candidates who have performed penetration tests at other companies

3. Communications skills: A pen tester must be able to convey the results of the tests-and their potential implications-to both technical and nontechnical audiences

4. Certification: The two most widely recognized pen testing certification organizations are: Global Information Assurance Certification, which offers both GIAC Web Application Penetration Tester and GIAC Certified Penetration Tester, and International Council of Electronic Commerce Consultants, which offers Certified Ethical Hacker

5. Personality: Look for testers with the technical skills, but also the imagination to think like an attacker. Be careful; as one expert puts it, "You want someone who is imaginative but not an insurrectionist."

Keith Ferrell writes about information security and other technology subjects. Write to us at [email protected].

www.informationweek.com