Strategizing and Organizing for Penetration Testing

As security technology advances and organizational awareness of threats increases, so too do the adversaries who are developing and depending on new strategies to enhance speed and impact while evading detection.

Ransomware and malicious software persist as the preferred methods for big game hunting (BGH) cyber criminals, and the rising use of hands-on or “interactive intrusion” techniques is particularly concerning. In contrast to malware assaults that depend on automated malicious tools and scripts, human-led intrusions leverage the ingenuity and problem-solving skills of attackers. These individuals can mimic normal user or administrative behaviors, posing challenges in distinguishing between genuine activities and cyber-attacks.

The aim of most security professionals nowadays is to handle risk on a large scale. Achieving visibility, minimizing noise, and securing the attack surface throughout the organization necessitate the right personnel, processes, and security solutions.

By utilizing penetration testing services, companies can proactively combat these emerging threats and assist security experts in recognizing and confirming normal from potentially malicious actions. Penetration testing encompasses a variety of technologies, both human-operated and automated, and involves utilizing certified pentesting specialists, or ethical hackers, to replicate a cyber-attack on a network and its assets. Pentesters apply real-world tactics and techniques akin to those of attackers in a bid to uncover and exploit known or unknown vulnerabilities before a security breach transpires.

This proactive offensive security approach necessitates planning and readiness by security leaders to amplify the effectiveness of penetration testing, including selecting the appropriate security provider to align with your security and business goals.

Steps for Successful Penetration Testing

The subsequent steps are indispensable for adequately preparing and organizing for penetration testing, each of which will be elaborated further:

1. Formulate team: Identify the security leaders participating in the penetration testing initiative, including appointing a primary point of contact (POC) or central coordinator. Define roles and responsibilities and establish clear goals.
2. Principal parties: Pinpoint the primary stakeholders and decision-makers. Define their roles and specify when their approvals will be required and at which phase of the penetration testing.
3. Develop a work plan: Create a well-defined work plan detailing the scope of the testing, specific systems and assets to be assessed, timeline, goals, and anticipated results.
4. Opt for a testing approach: Select a suitable testing approach that matches the scope. Popular approaches include Black Box, White Box, and Gray Box testing. Also, consider the specific tactics your organization wishes to employ, whether it pertains to social engineering, API Fuzzing, external-facing web app testing, etc.
5. Support for the security squad: Consider the necessary support for the security team and assess whether the organization possesses the requisite expertise, resources, and budget. Decide whether the project will be managed internally or if an external pentesting service provider is required. If opting for an external service provider, inquire about the level of support and expertise they offer.
6. Interaction with the vendor: Subsequent to conducting some research, ensure to pose pertinent queries when selecting a vendor. Queries may encompass, though are not limited to:
   • Is penetration testing a core aspect of your business operations?
   • Do you possess professional liability insurance?
   • Can you furnish references or testimonials?
   • Do you maintain the necessary pentesting certifications like ISO 9001 or CREST?
   • What qualifications do your pentesters hold?
   • How do you stay abreast of the latest vulnerabilities and exploits?
   • What is your pentesting methodology and pricing structure?
7. Post-Assessment Review: Compiling a comprehensive report of the assessment findings and recommendations for mitigation is crucial. Conduct a review with your team, and if using an external pentesting service provider, to analyze the findings and the potential risks associated with them. Work closely with stakeholders to ensure clear comprehension of the outcomes and agreement on a schedule for timely remediation.
8. Steps for Corrective Action: Draft a detailed findings report and provide distinct guidance on prioritizing vulnerabilities based on severity, outlining corrective actions to mitigate these risks. Maintain effective communication, accountability, and swift resolution.
9. Revalidation and Assessment: Additional reassessment may be essential to confirm the effectiveness of the mitigation efforts and their successful resolution. Ensure that no fresh issues emerge during the penetration testing process.

Preparations for Penetration Testing Services

Grasping Your Attack Surface

To comprehend your attack surface, gaining complete visibility of your cyber assets is imperative. Three primary considerations exist for understanding your attack surface:

1. Visibility of Your Attack Surface: Detect concealed and unmanaged cyber assets

As an organization’s digital footprint expands, attackers are increasingly exploiting the attack surface. This expanded attack surface facilitates the identification of vulnerabilities by malicious actors while complicating the task of safeguarding the IT infrastructure for security professionals. Uncovering all cyber assets and potential vulnerabilities can pose a significant challenge. Without comprehensive insight into all conceivable attack vectors, evaluating and communicating an organization’s risk exposure becomes nearly unfeasible.

2. Risk Prioritization: Decision-making based on risk

Maintaining awareness and evaluating risk without ongoing assessments exposes organizations to vulnerabilities. Security leaders require clear visibility into the primary risk-influencing factors to guide strategic decisions and keep stakeholders informed. By regularly evaluating risks, DevSecOps teams acquire actionable insights that bolster defenses, rectify vulnerabilities, and avert security breaches.

3. Risk Mitigation: Minimizing risk associated with the attack surface

Security professionals often find themselves reacting to threats, constrained by limited time and visibility, without the foresight needed to anticipate risks. A broad attack surface necessitates more than merely enhancing threat defenses – it requires proactive measures to uncover, assess, and resolve cyber risks before an attacker exploits them.

Determining the Best Approach for Penetration Testing

Extent

Prior to commencing testing, take into consideration the following points when determining the span of a penetration test:

1. Determine what to examine: Which regions and possessions would the enterprises like to assess? This involves recognizing critical systems, applications, networks, or data that may be susceptible to breaches.

2. Set objectives: Security teams should also contemplate the business goals for conducting penetration tests, whether it involves focusing on human security levels through phishing techniques or testing endpoints that are susceptible to bypassing. It is vital to understand where potential vulnerabilities could exist in specific areas or to evaluate the entire infrastructure.

3. Adherence prerequisites: Certain sectors have particular regulations that might stipulate what needs to be incorporated in your penetration test. Being aware of the regulations the organizations need to adhere to along with the testing requirements can help narrow down the assessment scope.

Security experts should possess this information as well as crucial details such as organizational structure, domains, servers, devices with IP addresses, or authorized user credentials (based on the pentesting method), and any exclusions.

Which are Some Common Properties to Assess?

Outer Possessions

Internet-based Applications: The prevalent external asset(s) that benefit from penetration testing services are web applications. External web app penetration testing identifies potential breach routes and addresses specific vulnerabilities based on the applications’ structure and employed technology. These are often referred to as internet- or public-facing applications that are reachable via the internet. The common vulnerabilities identified include SQL injections, XSS, authentication and/or business logic flaws, credential stuffing, and others.

In addition, penetration testing services for external properties can encompass, but are not restricted to, mobile applications, APIs, Cloud, external networks, IoT, and secure code review.

Internal Possessions

Networking Framework: The primary penetration testing for internal assets involves internal networks and systems. Many security practitioners and organizations presume that internal networks are more secure than external-facing systems; however, this notion is no longer accurate. The aim of attackers who manage to breach an internal network is to move sideways across systems, heightening privileges, and jeopardizing confidential and sensitive data. The prevalent vulnerabilities identified include misconfigured active directories (ADs), feeble passwords or inadequate authentication, and obsolete or unpatched software and systems.

Penetration testing services for internal assets can encompass but are not restricted to, internal applications, APIs and API endpoints, workstations and laptops, Thick Client applications, and testing throughout all phases of the software development life cycle (SDLC).

Which Style of Penetration Testing Is Suitable For You?

There are several penetration testing methodologies available, and determining the suitable approach will be dictated by the parameters outlined in your scope. Penetration testing techniques have advanced, freeing companies from relying solely on traditional penetration testing provided by leading consulting firms. Presented below are the various pentesting methods at hand and how they are commonly used to yield optimal outcomes.

1. Conventional Penetration Testing: This format, project-based and traditional in approach, is provided by prominent global consulting firms. This testing method is hands-on and entails a well-defined scope and schedule, where external security specialists carry out tests on specific systems, networks, or applications. This sort of conventional pentesting can appear more credible by offering assurance to stakeholders and auditors and may be rather costly as these firms usually demand a premium for their services, making them less affordable for small or mid-sized enterprises.

Traditional pentesting typically transpires annually or biannually, which might lead to gaps in security surveillance between assessments. Attack surfaces evolve rapidly, implying that new vulnerabilities could remain undetected during this interval.

Moreover, these traditional engagements generally take a considerable amount of time to kick off, and the feedback loops might seem sluggish. The results might take weeks or months to be furnished, and by that time, some vulnerabilities may no longer be pertinent.

2. Self-sufficient Penetration Testing: Automated penetration testing deploys automated tools, scripts, and AI to conduct security evaluations without incessant human intervention. Similar to other pentesting methods, it can simulate a range of attack scenarios, recognize vulnerabilities, and offer remediation recommendations. Automated penetration testing can execute the same duties that necessitate manual testing, but it is carried out continuously or on a scheduled basis.

Automated penetration testing primarily concentrates on networks and network services and can proficiently scan extensive network infrastructures. This type of pentesting can also carry out static and dynamic scans of web applications to pinpoint typical vulnerabilities, as well as APIs and API endpoints, cloud and external-facing assets like public websites, databases, and networks as it can be recurrently scheduled and is less susceptible to human error.

Automated penetration testing delivers speed, scalability, and cost efficiencies. Independent tools can be deployed to run pen tests regularly, granting continuous monitoring and enabling the identification of vulnerabilities as they surface. Nonetheless, automated tools often target common, well-known vulnerabilities and may overlook intricate or more sophisticated weaknesses that a human tester could discern.

3. Penetration Testing as a Service (PTaaS): PTaaS constitutes a hybrid or mixed approach to penetration testing using both automated and human-led pentesting, leveraging the advantages of both, such as promptness, scope, and consistency. Manual pentesting is executed by certified and exceptionally skilled ethical hackers who scrutinize for vulnerabilities in a system, application, or network. It employs a comprehensive, human-led approach, and unlike automated tools, manual pentesting allows for greater expertise, intuition, and adaptability in identifying complex vulnerabilities.

PTaaS encompasses the complete IT infrastructure, both internal and external, and can be individualized for deeper exploration of specific areas of concern. During manual pentesting, specialists can think akin to attackers, applying techniques akin to those employed by malevolent actors, and can tailor specific use cases or uncommon configurations for testing to align with the organization’s IT environment. Manual testers can also readjust their strategy if they encounter unforeseen scenarios or barriers.

Adopting a hybrid approach to penetration testing combines the efficiency, scalability, and cost-effectiveness of continual automated testing with the creativity and adaptability of manual testing, essential for unearthing complex and advanced vulnerabilities like business logic flaws. Merging both methods imparts the speed and breadth of automated tools with the depth of manual testers to ensure more thorough and extensive coverage of the attack surface.

Planning for Your Penetration Testing

Selecting the Suitable Pentesting Services and Provider

Picking between internal and external pentesting resources is a crucial decision and is often influenced by the scope and goals. Differentiating between an organization’s internal pentesting team,a third-party pentest provider who utilizes their own internal pentesting specialists, as well as external resources like crowdsourcing, each come with their distinct strengths and weaknesses.

Internal Intrusion Testing Within Enterprises

• Insider Viewpoint: Emulates an assault from within the enterprise and offers an insider’s viewpoint.
• Internal Infrastructure: Can provide an extensive evaluation of internal systems, encompassing lateral movement and privilege escalation.
• Economical: If the skills and resources are available within the organization, pentesting can frequently be more cost-efficient, cutting down on unnecessary external costs.
• Continuous Enhancement: Internal teams can carry out frequent testing and monitoring, resulting in more regular updates and enhancements.

Appropriate Usage: Internal intrusion testing is most suitable for recognizing and mitigating internal risks, evaluating internal regulations, and ensuring the security of internal systems.

External Invasion Testing with Service Provider and In-house Accredited Specialists

• Specialized Proficiency: In-house pentesting specialists employed by a penetration testing service provider are highly qualified certified ethical hackers and uphold the most up-to-date industry certifications such as CREST, OSCP, OSCE, CEH, CISA, CISM, SANS, and others.
• Impartial Perspective: External pentesters can deliver an impartial viewpoint, often pinpointing vulnerabilities that internal teams might overlook.
• Standardization: Utilize standardized methodologies and principles aligned with NIST, OWASP, CREST, and MITRE ATT&CK practices.
• Assistance and Tailoring: Pentesting providers also offer the direction needed to select the appropriate pentesting approach, delivering support throughout the entire testing process, with the capability to modify and personalize security testing to match your business prerequisites.

Appropriate Usage: External intrusion testing is ideal when resources and expertise are restricted. It is ideal for evaluating both internal and externally facing assets using standardized methodologies for more precise and uniform outcomes. Additionally, it is best employed for ensuring regulatory adherence and securing an impartial evaluation of your security position.

External Intrusion Testing or Crowdsourcing

• External Assets: This involves external intrusion testing resources either through a security service provider that utilizes crowdsourcing or the engagement of external intrusion testing specialists
• Lack of Regularity and Uniformity This process will lack uniformity and regularity in the usage of intrusion testing tools, often resulting in differing outcomes that can be challenging to evaluate overall progress
• Heightened Expenses: External pentesters might be more costly due to consultancy charges and the requirement for specialized services
• Restricted Frequency: External intrusion testing is typically performed episodically rather than continuously, leading to intervals between tests.

Appropriate Usage: External pentesters or crowdsourcing are beneficial to verify outcomes from internal intrusion testing for confirmation. Nevertheless, the lack of uniformity and regularity of results remains a matter of concern.

Which is the Appropriate Intrusion Testing Methodology?

Various standardized practices are commonly used in intrusion testing to ensure accuracy, uniformity, thoroughness, and conformity with industry norms. Several well-known practices are as follows:

1. NIST (National Institute of Standards and Technology)

These practices present pragmatic suggestions for developing, implementing, and sustaining security testing and operations. They are intended for industry, governmental, and organizational use to help lessen cybersecurity risks. NIST covers different aspects of security testing, encompassing intrusion testing, vulnerability scans, risk evaluations. These guidelines from NIST are broadly acknowledged and followed by federal bureaus and organizations to ensure a uniform approach to security testing.

2. OWASP (Open Web Application Security Project)

OWASP delivers a comprehensive structure for testing web applications, involving methodologies for recognizing and mitigating prevalent web application vulnerabilities. OWASP is highly esteemed for its concentration on web applications – but also includes frameworks for mobile apps, APIs, cloud, and more – and the guidelines are open-source and routinely refreshed to mirror the most recent threats and best practices.

3. CREST (Council of Registered Ethical Security Testers)

A non-profit authorization organization that establishes stringent standards for security testing, encompassing intrusion testing, to ensure that member entities conform to rigorous ethical, legal, and technical norms. CREST defines a uniform methodology for intrusion testing, covering planning, data collection, vulnerability analysis, exploitation, and reporting.

Other Noteworthy Practices:

• MITRE ATT&CK: A worldwide knowledge repository of adversary tactics and methodologies derived from real-world observations utilized to devise specific threat models and methodologies in the corporate, governmental, and cyber community sectors. In contrast to classic intrusion testing frameworks, MITRE ATT&CK presents a comprehensive matrix of methods employed by attackers during various stages of an assault.
• PCI DSS (Payment Card Industry Data Security Standard): Establishes requisites for executing intrusion tests to guarantee the security of cardholder data.
• OSSTMM (Open-Source Security Testing Methodology Manual): Furnishes detailed methods for security testing, covering various facets of operational security.
• HIPAA (Health Insurance Portability and Accountability Act): Encompasses guidelines for intrusion testing to ensure the security of protected healthcare information.

Regulatory Adherence through Intrusion Testing

Conforming to regulatory directives has turned into a crucial aspect of conducting penetration tests. At present, industries are compelled to align with a myriad of data protection and security laws to prevent breaches and safeguard sensitive information effectively.

In every corner of the globe, there is an ongoing trend towards increasingly strict regulations impacting diverse sectors, notably the financial, healthcare, and critical infrastructure industries. Here is an outline of some prominent regulations, a few of which come with specific directives concerning penetration testing:

THREAT-LED PENETRATION TESTING (TLPT) UNDER DORA

To address the growing risks emanating from information systems and IT infrastructure, both internal and external, EU regulators have introduced rules and recommendations aimed at identifying and resolving potential vulnerabilities. DORA mandates two distinct types of testing for financial institutions to enhance their cyber resilience:

1. Digital Operational Resilience Testing: Compulsory for all entities under DORA’s regulation, to be conducted annually for systems and applications supporting critical or vital functions, and
2. Threat-Led Penetration Testing (TLPT): Mandatory for the most critical financial entities, as determined by competent authorities in each nation, with TLPT carried out at least once every three years.

NETWORK AND INFORMATION SYSTEMS (NIS) REGULATIONS, THROUGH NCSC CYBER ASSESSMENT FRAMEWORK (CAF)

CAF holds significant importance for public sector bodies and entities involved in supporting Critical National Infrastructure (CNI), offering a methodical approach to evaluating an organization’s cybersecurity practices. It aids in pinpointing and rectifying areas requiring enhancement. Particularly crucial for bodies governed by the NIS Regulations, which demand the adoption of effective cybersecurity measures. Furthermore, the framework proves invaluable for sectors dealing with risks to public safety, such as healthcare and transport.

NIS2 DIRECTIVE

The NIS 2 Directive (Directive (EU) 2022/2555) aims to establish a high level of cybersecurity consistency across the EU. Member States are tasked with ensuring essential and significant entities implement the requisite measures to mitigate network and information system risks, reducing the impact of incidents, adopting a comprehensive approach to all hazards.

TIBER-EU (THREAT INTELLIGENCE-BASED ETHICAL RED TEAMING)

This initiative is an EU program devised to enhance the cyber resilience of entities within the financial domain. TIBER-EU provides a structured method for conducting controlled, intelligence-driven red team assessments. These simulations replicate real-world cyber assaults, assessing and enhancing the security stance of organizations.

SOC 2 (SYSTEM AND ORGANIZATION CONTROLS 2)

A well-recognized regulatory outline and auditing process formulated by the American Institute of Certified Public Accountants (AICPA). Its purpose is to appraise the controls and security measures adopted by service organizations to safeguard customer information, ensuring the security, availability, processing integrity, confidentiality, and privacy of data.

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)

This federal law in the U.S. regulates the privacy, security, and electronic transmission of medical records. Medical and healthcare entities must regularly validate the security controls protecting their data, incorporating guidelines for penetration testing to secure protected health information.

PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)

Defines the stipulations for conducting penetration testing to safeguard cardholder data. PCI DSS 11.3.1 mandates external penetration tests at least biannually and following significant alterations or upgrades to IT systems or applications. Additionally, PCI DSS 11.3.2 necessitates internal penetration tests biannually. Extra requirements within PCI DSS call for further penetration testing, detailed on their website.

WRAPPING UP

Planning and organizing penetration testing services is a considerable endeavor, requiring thorough preparation and resolution of numerous queries before commencing testing. Nonetheless, the advantages of penetration testing services undoubtedly make the effort worthwhile, fostering a robust security posture for the present and future.

About Author