Penetration Testing uses the same tools and techniques of a black hat hacker in order to identify vulnerabilities. Lisa Bock covers how penetration testing monitors for threats from the outside as well as the inside and why every organization should include Penetration Testing as part of an overall security plan.
- [Voiceover] Once a decision is made to conduct ethical hacking, the approach to the penetration test, or pen test as it is sometimes called, is determined in a kickoff meeting with all stakeholders that establish the goals of the security assessment. Ethical hacking is a structured assessment and testing process. Ethical hacking uses the same tools and techniques of a black hat hacker, and of course were sometimes called white hat hackers. Ethical hacking examines the many ways a breach can occur.
In the early days of networking, perimeter scanning to test a system's ability to withstand attempts to break through the boundary firewalls were sufficient. However, today's network edge has blurred. Security threats have evolved and expanded beyond the corporate walls. So have the types of security assessments that are conducted. Security assessments can include network devices, email, web interface, hosts, wireless application, and databases.
A total assessment can take two to three weeks. It really depends on the number of targets that are identified in the kickoff meeting. A pen test will answer the following questions: How vulnerable is the target from the Internet or intranet? What are the exploitable vulnerabilites? Are our anti-malware signatures up to date? Are operating system patches current? Or do we have unneccessary services running? Penetration testing monitors for threats from the inside as well as the outside.
An inside attack occurs when someone inside the network breaches the system. An insider has an advantage as they are generally trusted, and have a better knowledge of the network architecture. Inside attacks occur more often than we think. Insider attacks are on the rise. They're very dangerous and costly. The need for penetration testing may come from a directive or law. In 2012, the Federal Information Security Management Act, or FISMA, created guidelines for the United States agencies in order to create and implement risk-based policies and procedures, to provide security protection for data, along with performing periodic penetration testing on all systems and data.
For organizations, there are several other laws that govern data protection in an organization, such as PCI-DSS, which is Payment Card Industry Data Security Standard. This compliance is done in order to secure credit card information. HIPAA protects patient information. Whether a company is required by law to ensure data protection, security is everyone's business. Logically securing a network is not enough to ensure the safety of information assets in an organization.
Whether a government mandate or not, every organization should include penetration testing in addition to a comprehensive security plan.
Security expert Lisa Bock starts with an overview of ethical hacking and the role of the ethical hacker. She reviews the kinds of threats networks face, and introduces the five phases of ethical hacking, from reconnaissance to covering your tracks. She also covers penetration-testing techniques and tools. The materials map directly to the "Introduction to Ethical Hacking" competency from the CEH Body of Knowledge, and provide an excellent jumping off point for the next courses in this series.
Note: Our Ethical Hacking series will map to the 18 parts of the EC-Council's certification exam. Find more courses in the series on Lisa's author page.
- Ethical hacking principles
- Managing incidents
- Creating security policies
- Protecting data
- Conducting penetration testing
- Hacking in phases