Information Security Blog

Improving the Accuracy of a Penetration Testing Using Credentials

On first blush providing credentials to a tiger team conducting penetration tests sounds like giving the fox a key to the chicken coop. However, there are many cases where it can provide significant value. For example; you want to assess whether an authenticated user (network or application) can escalate privilege. Another great place to use credentials is during the Vulnerability Assessment phase of a network Penetration Test.

A network vulnerability scan is essentially a “best effort”. The three predominant challenges to Vulnerability Assessments are;

The scanner assumes that the host it is interrogating is “trustworthy” (the level of trust is usually adjustable) and bases its assumptions as to the services, versions, and vulnerabilities on the answers it receives. The false positives we are all familiar with are assumptions gone awry.
The scanner cannot directly assess many important system settings, for example the password policies’ complexity setting or the system audit policies event logging settings.
Packet filtering “devices” in the network path between the scanner and the device (e.g., firewalls, load balancers, routers, network IPs, Host-based IPs) may respond on behalf of the device, providing incorrect data and a false sense of security.

The key benefit to running the vulnerability scan with administrative level credentials is that it allows the scanner to directly assess the system’s configuration rather than guess it based on the answers it received. This not only provides a greater quantity of, and more accurate, information, but it opens up the possibility of using the vulnerability assessment as a compliance check against relevant standards (e.g., PCI, Center for Internet Security, or organization specific). The last benefit is that a vulnerability scan with credentials avoids most of the problems encountered with packet filtering devices in the path as the scan is essentially local and authorized.

In a future blog we will look at one of the other unique benefits of running a credentialed scan – running a content scan on the hosts at the same time to determine whether sensitive data (e.g., credit card, medical, identity theft, intellectual property) exists on the systems in violation of policy.

Best Practices for Firing A Network Security Administrator

Want to know how to fire a Network Admin? Need to know what precautions to take? Firing any employee can be a stressful event. Firing one who has significant knowledge of and privileged access to your Information Technology/Security infrastructure is even more stressful, as the risks are so notable.

Download: Information Security Attestation Guide

A Best-Practices Guide to Information Security Attestation

Download our proven Information Security Guide to simplify the process of protecting your data, proving you’re secure and growing your business.

Is ISO 27001 Right for (Y)our Organization?

Thinking about ISO 27001 Certification? View our free On-Demand ISO 27001 Webinar

How to deal with increasing threats
How to manage multiple regulatory requirements
How to handle client requests for attestation
To validate that significant changes did not have unanticipated results

Free Whitepaper: Five Best Practices for SIEM

The promise of SIEM is the consolidation of all relevant Security Event Logs from disparate sources into a single unified and normalized data store.

Simplify compliance monitoring/reporting
Vastly improve Incident Detection & Incident Response
Contextualize event information with other business relevant information

Free Download: A Best Practices Guide to Database Security

Because data is only as secure as the systems & processes it relies on – a holistic approach to data security is essential. This roadmap is not meant to be exhaustive but rather to stimulate the necessary thought process to put you on the path to good data security.

Free Whitepaper: Stop Wasting Money on Penetration Testing

Penetration Testing is most frequently performed to:

Substantiate the net effectiveness of a mature control environment
Prove to a third party that an environment is secure/trustworthy
Quickly assess the security of a less mature control environment (in a sense a technical risk assessment)
To validate that significant changes did not have unanticipated results