Part 2: Why Perform a Pen Test?

Identify vulnerabilities and
weaknesses.

Check effectiveness of existing
security controls.

Meet regulations and compliance standards.

Prioritize mitigation
and remediation.

Assess intrusion detection and
response systems.

Confirm publicly available
networks / systems.

Return to Top ⇑

Part 4: How to Perform a Pen Test: The Tyler Cybersecurity Methodology

At Tyler Cybersecurity, each cyber assessment engagement is customized to meet unique goals and objectives, therefore the specific elements of our methodology that are leveraged is contingent upon the level of testing and defined scope. The following is an accounting of the potential testing phases and their respective individual elements:

FOOTPRINT ANALYSIS / RECONNAISSANCE

Typically the first step, this entails searching various publicly available sources for detailed company-specific information. This allows us to identify target systems and provides information that may prove useful in an attack.

SYSTEM, SERVICE, AND VULNERABILITY IDENTIFICATION

In this phase, a variety of specialized security tools are used to identify the architecture and vulnerabilities. The goal is to identify systems / devices that respond to authorized and unauthorized requests, the services / applications that those systems are providing, and inherent and / or potential vulnerabilities.

EXPLOITATION

Here we attempt to gain unauthorized access to systems and / or information utilizing the vulnerabilities identified in the previous phase. Once we gain access to systems / information, we report the finding and move on in an attempt to find additional vulnerabilities.

REPORTING

In this final phase, we generate an executive summary and a technical report that explains the findings, provides customized remediation recommendations, and, if available, includes details on repeating the attack scenario.

INDUSTRY GUIDANCE FOR PENETRATION TESTING

Return to Top ⇑

Part 6: Pen Test vs. Vulnerability Assessment

There is a misconception that pen tests and vulnerability assessments are synonymous. It’s common to hear the terms used interchangeably. While both are critical components of a threat and vulnerability management process, they are very different engagements. It’s imperative you understand the differences between them, so you can select which is most appropriate at any given time.

OBJECTIVES

VULNERABILITY ASSESSMENT: Identifies known weaknesses in your environment. Findings may include unapplied patches, vulnerable software versions, and gaps in network controls. Primarily an automated assessment.

PEN TEST: Simulates a real-world attack and tests your existing defensive controls. Manual testing routinely finds vulnerabilities that automated vulnerability assessment tools are incapable of finding.

TOOLS

VULNERABILITY ASSESSMENT: Primarily performed using automated scanning tools such as Nessus, Qualys, or OpenVas, which are off-the-shelf software packages.

PEN TEST: Automated tools are leveraged for efficiency, however, the majority of this effort is manual and relies upon the skill-set and expertise of the pen tester.

DELIVERABLES / FINDINGS

VULNERABILITY ASSESSMENT: Typically a stock report listing all known vulnerabilities found during the scan, prioritized by severity and / or criticality with remediation recommendations.

PEN TEST: A more succinct report with vulnerabilities, ranked by severity with remediation recommendations, plus details on how an attacker could breach your defenses.

FREQUENCY

VULNERABILITY ASSESSMENT: Ideal for periodic testing between pen tests and as a quick verification when changes are made to the environment.

PEN TEST: Should be performed at least annually and any time significant changes are made to the environment.

Part 8: Elements of an Effective Pen Test

INDEPENDENT ANALYSIS / SEPARATION OF DUTIES

Information security best practices call for independent testing for several reasons. First, cybersecurity specialists have the latest, most sophisticated technologies and the most current information on exploits. Also, internal teams may see things during tests that should trigger a response, but get ignored because they know the idiosyncrasies of their IT infrastructure — a common but dangerous mistake.

RESEARCH & RECONNAISSANCE

Determining the appropriate scope, defining an effective methodology, and establishing a practical blend of automated vs. manual testing are critical components of an effective pen test. Before any testing begins, the pen tester should have a clear picture of the unique environment. This knowledge is gained through research and reconnaissance.

SECURITY EXPERTISE & TRAINING

A skilled pen tester looks at the vulnerabilities found during a scan, then using research, validates that the vulnerabilities are accurate, and determines how to best take advantage of them to gain access to the system. Having the skill-set to understand the orchestration between what the automated tool reports and how to manually exploit findings is how value is derived from a pen test.

ACTIONABLE INSIGHT

When testing is completed, you need to have actionable findings and effective remediation recommendations. This allows you to prioritize your subsequent remediation process according to your most critical vulnerabilities. After all, what’s the point of going through the time and effort unless you’re committed to improving your network security posture?

Return to Top ⇑