Security Through Penetration Testing example essay topic

Penetration TestingABSTRACTPenetration testing has been well popularized by the media. Many companies are now offering penetration services to identify vulnerabilities in systems and the surrounding processes. This report will Discuss "Penetration Testing" as a means of strengthening a corporate network's security. This report is divided into three parts. Introduction will give you a brief and basic overview of Penetration Testing and why we need Penetration Testing, The second part is the technical breakdown explains The strategy, model and type of Penetration Testing. In the conclusion, we will discuss both the value and limitation of Penetration Testing.

1. INTRODUCTION As electronic commerce, online business-to-business operations, and global connectivity have become vital components of a successful business strategy, enterprises have adopted security processes and practices to protect information assets. But if you look at today's computing environments, system security is a horrible game of numbers: there are currently over 9,223 publicly released vulnerabilities covering known security holes in a massive range of applications from popular Operating Systems through to obscure and relatively unknown web applications. [01] Over 300 new vulnerabilities are being discovered and released each month.

Most companies work diligently to maintain an efficient, effective security policy, implementing the latest products and services to prevent fraud, vandalism, sabotage, and denial of service attacks. But the fact is you have to patch every hole of your system, but an attacker need find only one to get into your environment. Whilst many organisations subscribe to major vendor's security alerts, these are just the tip of the security iceberg and even these are often ignored. For example, the patch for the Code Red worm was available some weeks before the worm was released. [02] 1.1 What is Penetration Testing?

Penetration testing - using tools and processes to scan the network environment for vulnerabilities, [03& T, J. K et al. 2002] there are many different types of vulnerability assessments. Penetration Testing focuses on understanding the vulnerabilities of components that you " ve made available on the network as seen from the perspective of a skilful and determined attacker who has access to that network. It will provide a thorough overview of the state of the organisation's technical security by simulating an expert attack, helps refine an enterprise's security policy, identify vulnerabilities, and ensure that the security implementation actually provides the protection that the enterprise requires and expects. A good Penetration Testing also providing an easy to understand report with corrective actions and follow up recommendations. Regularly performing penetration tests helps enterprises uncover network security weaknesses that can lead to data or equipment being compromised or destroyed by exploits.

It is important to point out that a penetration test cannot be expected to identify all possible security vulnerabilities, nor does it offer any guarantee that a company's information is secure. Penetration testing is typically conducted at a point in time. New technology, new hacker tools and changes to a company's information system can create exposures not anticipated during the penetration testing. In addition, penetration testing is normally completed with finite resources, focused on a particular area, over a finite period of time. Hackers determined to break into a company's information systems are often not bound by similar constraints. 1.2 Why Penetration Testing By simulating the actions that a hacker might perform, and company can gain valuable insights into the effectiveness of the security controls in place over its information systems.

Penetration testing can identify vulnerabilities that unauthorized users could exploit. It can also identify more pervasive gaps and deficiencies in the organization's overall security processes including, for example, its ability to identify, escalate and respond to potential security breaches and incidents. Firstly, Protecting a company's information and systems is a business imperative the price of entry for successful business in a networked economy. Increasingly, management, audit committees, boards of directors, customers, consumers and other stakeholders are requiring assurance that the company is taking appropriate measures to protect its information and the information entrusted to it. Audit opinions on the adequacy of controls over information systems.

[04] Secondly, all information technology components in use today have potential security vulnerabilities. Some vulnerability are a consequence of the inherent limitations in the performance or design of the particular technology. Other vulnerabilities arise from the way the technology is configured or programmed for use. Regardless, these inherent vulnerabilities are widely publicized by technology vendors, security companies and the hacker community on the Internet, and are available to anyone with professional or malicious interest. A proliferation of powerful computers and software tools, coupled with the growing number of people who are inclined to use such tools for fun, mischief or profit, leads many to believe that the number of potential attackers and the types of potential attacks is increasing faster than the improvement in security techniques. The term "hacker" conjures up the image of an external person attempting to exploit security vulnerabilities to gain unauthorized access to a company's information systems.

Exposure to security vulnerabilities is not, however, limited to those external to the company. Internal, "authorized" users of a system also present a significant security exposure. According to a recent survey, [05] 75% of respondents cited that disgruntled employees are the most likely source of attacks. Employees or other trusted parties were those most likely to be responsible for vandalism, theft of information and sabotage of data. Hackers, both internal and external, identify targets through choice and opportunity. A "target of choice" is one that is specifically identified and selected.

Hackers penetrate targets to achieve notoriety within their community or to reap more tangible benefits from, say, information theft and industrial espionage. Large, high-profile companies, such as governments and financial institutions, are regular targets of choice. Employers and former employers often represent targets of choice for disgruntled employees, suppliers or contractors. A "target of opportunity", on the other hand, has been selected because of fortuitous circumstances, such as relative ease of access, availability of insider information, or luck. As such, almost any company can be a target of opportunity. Internal attacks also present a significant exposure, as employers and former employers often, perhaps unknowingly, provide ample opportunity for disgruntled employees, suppliers or contractors to attempt unauthorized access.

Many companies have deployed sophisticated security mechanisms, such as firewalls or intrusion detection systems (IDS), to help protect their information assets and to quickly identify potential attacks. While these mechanisms are important, they are not foolproof. [06] A firewall cannot protect against what is allowed through - such as online applications and allowed services. While an IDS can detect potential intrusions, it can detect only what it has been programmed to identify, and it will not be effective at all if the company does not monitor or respond to the alerts. As well, firewalls and intrusion detection systems must be continuously updated or they risk losing their effectiveness at preventing or detecting attacks. Penetration testing can help validate and confirm the effective configuration of a company's firewalls and its intrusion detection systems.

2. TECHNIQUES OF ATTACK The penetration test should have clearly defined methodologies and goals. The ultimate goal is to see how secure your network is or from a hacker's point of view, how insecure your network is currently. You need to be able to test all systems that are on your network, no matter which operating system or application they run. The threat you are attempting to replicate should factor into the decision on how the test should be conducted by whom. Most auditing companies now provide some level of Penetration testing either from within their company, or sub contracted out to third party security companies.

Many companies are also looking at creating their own internal security teams that provide a constant day-to-day monitoring of networks and devices, and also spend valuable time researching the latest vulnerabilities from CERT's and collate the relevant security patches in-house under advisement from the Security Community to apply to company systems that are deemed vulnerable or compromised. 2.1 Testing Strategies Tests intended to identify vulnerabilities with physical access or exposures to social engineering are referred to as internal penetration tests. Internal penetration testing is conducted using automated software, including scanning tools, to detect potential vulnerabilities in target companies IS infrastructure. An internal test might better replicate the efforts a recently terminated employee might take when attempting to access valuable information. [T, J. K et al.

2002] Conversely, external penetration tests are intended to identify vulnerabilities that are present for connections that have been established through the company connection to the Internet (also known as the firewall or gateway). During the external network testing, the target company maintains its normal network configuration while the penetration test team attempts penetration over the Internet from its testing laboratory. The assessment usually consists of external scans to determine the level of vulnerability and war dialing to identify telephone computer connections to the sites and to attempt to penetrate these connections. [05& T, J. K et al.

2002 ] 2.2 Testing Models Consider that the goal of penetration testing is to mimic real-world attacks. Whom are you worried about? A bored 15-year-old or a temporary employee? A competitor's spy or a nation-state? Pinpointing the nature of the threat behind an attack allows the penetration team to emulate that threat. For the most useful results, a penetration team should use the same methodology or techniques that a specific adversary would.

While it's nearly impossible to have a thorough understanding of all of the threats, they can be broken down into four broad categories: o Script kiddie, has limited or no knowledge of how computer systems work. They rely on pre-written exploits and vulnerability scanners to find and realise vulnerabilities. o Malicious insider Does not necessarily know much about IT systems but does know a lot about system. This enables them to attack a system at its most vulnerable point. o Temporary employee, generally damages IT systems through an inability to correctly operate even the simplest applications. o Master hacker, Has intimate knowledge of IT technology and system code. They find original vulnerabilities, write customized exploits and spend much of their time learning and finding flaws in new technology.

There are two distinct models for penetration testing - the Zero Knowledge test and a Full Knowledge test. With the former, the tester is given no insight into the target systems under investigation; this type of test is obviously designed to provide the most realistic penetration test possible. With a Full Knowledge test, however, the tester is given complete information about them; this approach is designed to simulate an attacker who has intimate knowledge of the target company's systems, such as an actual employee. Zero Knowledge tests are useful when trying to ascertain how vulnerable systems are from the attack profile of the Script Kiddie. These are the most common type of attackers and are generally regarded as no more than Internet vandals. They typically attack the easiest targets they can find and with complete disregard.

They rarely conduct any research and normally start an attack as soon as the target is acquired. [07 & T, J. K et al. 2002] A Full Knowledge attack sets out to accurately model the attack characteristics of a Master Hacker or Malicious Insider. This is because both of these individuals will already know a great deal about an organisation's systems - Malicious Insider, or will carry out extensive research - Master Hacker, in order to identify the best ways of attacking a system.

[08 & T, J. K et al. 2002] 2.3 Types of Testing In addition to the penetration testing strategies to be used, consideration should be given to the types of testing the testing team is to carry out. These could include: o Application security testing. Many companies offer access to core business functionality through web-based applications.

[09] This type of access introduces new security vulnerabilities because, even with a firewall and other monitoring systems, security can be compromised, since traffic must be allowed to pass through the firewall. The objective of application security testing is to evaluate the controls over the application and its process flow. Topics to be evaluated may include the application's usage of encryption to protect the confidentiality and integrity of information, how users are authenticated, integrity of the Internet user's session with the host application, and use of cookies - a block of data stored on a customer's computer that is used by the web server application. o Denial of Service (DoS) testing. The goal of DoS testing is to evaluate the system's susceptibility to attacks that will render it inoperable so that it will "deny service", that is, drop or deny legitimate access attempts.

Decisions regarding the extent of Denial of Service testing to be incorporated into a penetration testing exercise will depend on the relative importance of ongoing, continued availability of the information systems and related processing activities. [10 & T, J. K et al. 2002] o War Dialing. War dialing is a technique for systematically calling a range of telephone numbers in an attempt to identify modems, remote access devices and maintenance connections of computers that may exist on a company's network. [11 & T, J. K et al. 2002 ] Well-meaning users can inadvertently expose the company to significant vulnerability by connecting a modem to the company's information systems.

Once a modem or other access device has been identified, analysis and exploitation techniques are performed to assess whether this connection can be used to penetrate the company's information systems network. o Wireless network penetration testing. The introduction of wireless networks, whether through formal, approved network configuration management or the inadvertent actions of well-meaning users, introduce additional security exposures. Sometimes referred to as "war-driving", hackers have become proficient in identifying wireless networks simply by "driving" or walking around office buildings with their wireless network equipment. The goal of wireless network testing is to identify security gaps or flaws in the design, implementation or operation of the company's wireless network. [12] o Social Engineering. Often used in conjunction with blind and double-blind testing, this refers to techniques using social interaction, typically with the company's employees, suppliers and contractors, to gather information and penetrate the company's systems.

Such techniques could include: posing as a representative of the IT department's help desk and asking users to divulge their user account and password information; posing as an employee and gaining physical access to restricted areas that may house sensitive information; intercepting mail, courier packages or even trash to search for sensitive information on printed materials. Social engineering activities can test a less technical, but equally important, security component: the ability of the company's people to contribute to or prevent unauthorized access to information and information systems. [13] 3. CONCLUSION 3.1 Advantages of Penetration Testing Penetration testing is a useful tool for vividly illustrating the potential impact of exploited security vulnerabilities. Show any company a printout of their payroll or an audit, and chances are they " ll recognize the need for improvements in security. For the test results to have maximum impact, the tester needs to put them in terms easily understood by the target company's management.

Many non-technical managers either don't care or won't understand the need for systems security until the consequences of an attack are spelled out in plain language. A tester needs to detail the potentially costly and damaging ramifications-ranging from loss of records to loss of business-should someone gain access to a company's systems in the same manner as the testing team. Penetration tests are ideal for testing detection and response capabilities. Given that most computer emergency response teams are woefully unprepared and inexperienced, the penetration test provides a great opportunity to gain experience in a consequence-free exercise. Penetration tests are a great tool for determining the current security posture of a company. A new CIO will often order a penetration test to get a quick understanding, or 'snapshot,' of problem areas.

The results will provide direction on allocating limited resources. 3.2 Test Limitations Despite its advantages, penetration testing has several limitations. A typical penetration exercise is not a comprehensive evaluation of security, since many security issues and configuration problems may not be identified. If the limited nature of penetration tests is not understood, the exercise can give a company a false sense of security.

For instance, if a host is not compromised during network attacks, the penetration testers will not be able to check its configuration for privilege-escalation vulnerabilities. Moreover, the results of a test only reflect the security status for the testing period. Even minor administrative and architectural changes to the environment performed only moments after a penetration test could alter the system's security profile. [14] It may be obvious, but it's still worth stating: A penetration test is only as good as the people conducting it.

The difference between identifying potential vulnerabilities and gaining interactive remote access to hosts requires a quantum leap in skill level. Commercial vulnerability scanners and free information-gathering tools provide the average systems administrator with the ability to identify potential vulnerabilities. Exploiting those vulnerabilities, escalating privileges and leveraging vulnerabilities in a complex, heterogeneous network environment requires highly skilled, experienced individuals. Teams with diverse, complementary skill sets usually perform the best penetration tests.

3.3 The Future Future of Penetration Testing While the media focuses a lot on network and operating system vulnerabilities, the future of penetration testing is at the application level. Most companies have or plan to deploy e-commerce-related applications. These plans include transactional Web servers with back-end databases and connections to various systems within a company. The old-school mentality of 'put a firewall up to keep people out' doesn't work in today's environment. While most sites have some sort of firewall, attackers can breach security barriers by exploiting vulnerabilities in the various Web-facing applications.

Testing these apps is a difficult and time-consuming task because each environment has a slightly different implementation. The requisite skills necessary to perform these specialized reviews include extensive knowledge of Web technologies, such as HTML, ASP, Java, Java- Script, cookies, PERL, VB scripting, SQL and CGI programming, to name a few. There is a prodigious gap in the skill level needed to perform traditional network and operating system testing vs. a structured e-commerce application penetration review. Systems managers should choose wisely when selecting a vendor to test an e-commerce application environment. Remember: The browser is the new millennium's security weapon. Finally, penetration testing should never be regarded as a one-off service.

Systems change, threats emerge and business strategies evolve. Testing should be repeated at frequent intervals and particularly following major changes to an IT infrastructure. It's also important to remember that penetration testing is but just one form of testing and any organisation should develop an overall security testing strategy that is tailored to the threat models and security policies of their organisation. 4.

Hack I.T. : Security Through Penetration Testing. Addison-Wesley Professional.