PENETRATION TEST FREQUENTLY ASKED QUESTIONS

A penetration test is an assurance service where the actions of a malicious attacker are simulated to test the effectiveness of security controls on networks, applications, devices, and services. The aim of a penetration test is to identify as many vulnerabilities as possible on a given scope. Although a variety of tools are used, at Dionach penetration testing is predominantly a manual exercise using the skills of the qualified penetration tester.

A vulnerability scan is an automated series of tests that look for vulnerabilities within a given scope, producing a report of any known vulnerabilities it finds, with templated recommendations. Although a very useful exercise, vulnerability scanners are prone to flagging false positives and false negatives. They typically only rely on a database of known vulnerabilities, and do not attempt to chain vulnerabilities together. For example, the combination of a number of lower risk vulnerabilities used in combination could lead to a critical risk issue, which the vulnerability scanner would not highlight.

A penetration test on the other hand may use a series of automated tools initially to find any known vulnerabilities, however the skills of the individual penetration tester are the driving force behind the exercise. The tester will verify the results of any scans they perform, eliminating false positives. They will look to find proof of concepts of any discovered vulnerabilities. They will also use human intelligence and a systematic methodology to manually explore and exploit any discovered vulnerabilities. This would include combining vulnerabilities, exploring business logic, and applying their knowledge and experience.

Ideally, vulnerability scanning, and penetration testing should complement each other. It is relatively inexpensive to run regular vulnerability scans against your networks and applications in order to highlight any new known vulnerabilities. However, penetration testing should still then be done periodically, and with any significant changes to the scope.

Organizations that provide penetration testing services should possess both company and individual qualifications related to penetration testing, supported by organizations such as CREST and CHECK.

That depends upon the situation and your specific requirements. Many penetration testing engagements can be conducted remotely via the Internet, whether that be by direct access, or via VPN or VM/device shipped to your network. Remote testing does have the advantage of reducing travel costs and expenses. In some circumstances however, it may not be possible, or desirable to provide remote access to the environment, so an onsite visit may be required. Additionally, some of our clients prefer our testers to complete some or all testing onsite, so they can more easily interact during the process. Options will be discussed during the scoping exercise to find the best solution for your project.

A variety of in-house developed and publicly available tools are used throughout the penetration test. These include various scanners, open-source intelligence (OSINT) tools, vulnerability scanners, web application scanning tools, HTTP proxies, exploits and scripts customized for the application or network. These tools are continually reviewed and updated by our security specialists to ensure we are always one step ahead of the constantly evolving threats. The most important part of a penetration test however is always the manual testing process, where the qualified consultant selects the relevant tools for each circumstance, or potential vulnerability.

These refer to different contexts that a penetration test engagement can be approach.

• -Black Box
• This is where testing of a system or network is undertaken with no prior knowledge of its internal workings. From an assurance perspective, this means that testing is done without credentials or access to system documentation or source code.
• -Grey Box
• This is where testing of a system or network is undertaken with limited knowledge. From an assurance perspective, this means that login credentials may be provided to the system, but these may be limited to non-administrator level. Also, limited or no documentation would be available.
• -White box:
• This is testing of a system of network with full access to the entire system or network’s internal workings. This would typically include the tester having access to login credentials, design documents, source code, and stakeholder input.
•  

Each of these approaches has their benefit, when it comes to gaining assurance of the security of your systems, depending upon the aims of the test. Dionach’s consultant will walk through the best testing approach for your specific project during the scoping phase.

On a typical penetration test, you will be asked to whitelist the penetration tester and their source IP addresses on any Web Application Firewall (WAF) or Intrusion Prevention System (IPS). This may feel counter intuitive, when you are looking to gain assurance of the security of your system. However, this is a common and practical means of getting the most out of your test. One thing a real attacker has is time. They can very slowly and patiently chip away at your system under the radar over a very long period of time, evading WAFs and IPS. A penetration tester has a fixed amount of time to find as many vulnerabilities as possible. As soon as a penetration tester starts a scan it is likely that they will be blocked, meaning they would have to work very slowly to avoid detection, increasing the time (and cost) needed for the engagement. Whitelisting the WAF/IPS allows the penetration tester to more easily find and highlight as many vulnerabilities as possible, that can then be risk assessed and remediated. The WAF/IPS then provides an additional layer of protection over the top of an assured secure system.

There are situations where there may be a requirement to test the efficacy of a WAF / IPS, and there are many techniques that can be used to do this. For example, doing the initial test with WAF/IPS off, to find as many vulnerabilities as possible, then doing an exercise afterwards to see how easily any serious issues could be exploited with the WAF/IPS on. During the scoping exercise, we ensure that we fully understand the requirements, and ensure we recommend the most method of testing suitable type of testing.

Although all penetration testing companies will try and accommodate your requirement for penetration testing at the earliest opportunity, penetration testing services are in high demand, especially at certain times of the year. Our advice is to plan your penetration testing requirements in advance as much as possible to make sure you have time reserved for when you need it. At Dionach we will always ensure we match your service to the most appropriate consultant at the earliest availability. If an opportunity arises to move scheduled work to an earlier date, due to changes in availability, or cancellations, we will contact you.

If during the course of a penetration test, a serious issue is discovered that poses a significant risk to the system or network, Dionach will contact you as soon as the vulnerability is confirmed. At this point, knowledge transfer is key, and the consultant will be available to go over the detail of the vulnerability, and make recommendations for remediation, or mitigation.

At the conclusion of the penetration test, the tester puts together a detailed report of the findings of the test. The first part of the report is an executive summary which is an easily digestible summary of the findings, business implications and strategic recommendations. This is easily readable for technical and non-technical people and is useful when trying to get across the business implications of the findings.

The second part of the report is a detailed description of all highlighted issues, along with CVSS scores where appropriate, assessment of impact, likelihood of exploitation, and overall risk rating. Practical guidance and recommendations are made for each issue, within the context of the scope tested. These recommendations are manually constructed and are bespoke to your specific environment. The consultant is always available to discuss any of the issues once you have read the report, to ensure the full value is gained from the test.