… but I don’t feel fine (see REM if you don’t get the reference).

Over the last few years significant changes have taken place in the vulnerability discovery space. In the “old days” a vulnerability researcher would discover a vulnerability, report it to the vendor, wait an “acceptable” period of time (for the vendor to (hopefully) issue a patch) and then publically publish their work (and “exploit code”).

Fast forward to today, the picture is radically different. Vulnerabilities are bought and sold by both hackers and security companies, often on the shady side of the internet. To anyone in the InfoSec field this is old news; So how does this change Penetration Testing?

Network Penetration Testing is a form of substantiative testing, with three predominant objectives:

• Determine the probability that a system vulnerability can be exploited
• If so, determine the impact that the exploit would have on the entity?
• If so, “shock” management into action by demonstrating the impact in a non-ambiguous manner.

With the number of exploits being “publicly” disclosed dwindling (because the vulnerabilities are being purchased by a security company or other hackers) the amount of “safe” exploit code available to an ethical hacker is dwindling as well. Without exploit code the ability to achieve those three objectives  is radically reduced. Ethical Hackers looking to still “exploit” critical vulnerabilities have two choices:

• Leverage potentially dangerous exploit code acquired from sites like millw0rm. (However, the exploit may actually contain additional malicious code leaving your client’s machine compromised)
• License a commercial automated penetration testing application (e.g., Core Impact, Canvas) that is buying much of the exploit code on the market).

Frankly, I don’t think either option is all that good.

The first encumbers both the ethical hacker and the client with significant risk. Questionable exploit code could contain malicious content resulting in an activity intended to improve the security posture of the network, significantly reducing it.

The latter adds considerable cost, reduces the likelihood that multiple “lower risk” vulnerabilities that can yield access (i.e., leapfrogging or privilege escalation) will be identified (as experience is replaced by push button automation), and reduces/distorts the ability to truly measure probability and/or impact.

We all (clients and ethical hackers alike) have some tough decisions to make. It’s the end of network penetration testing as we know it.

Free Download: ISO 27001 Implementation Roadmap

Have no fear – our “roadmap” will guide you, step by step, through the entire ISO 27001 process.

Getting to ISO 27001 certification is a process made up of things you already know – and things you may already be doing!

Is ISO 27001 Right for (Y)our Organization?

Thinking about ISO 27001 Certification? View our free On-Demand ISO 27001 Webinar

• How to deal with increasing threats
• How to manage multiple regulatory requirements
• How to handle client requests for attestation
• To validate that significant changes did not have unanticipated results

Free Whitepaper: Five Best Practices for SIEM

The promise of SIEM is the consolidation of all relevant Security Event Logs from disparate sources into a single unified and normalized data store.

• Simplify compliance monitoring/reporting
• Vastly improve Incident Detection & Incident Response
• Contextualize event information with other business relevant information

Best Practices for Firing A Network Security Administrator

Want to know how to fire a Network Admin? Need to know what precautions to take? Firing any employee can be a stressful event. Firing one who has significant knowledge of and privileged access to your Information Technology/Security infrastructure is even more stressful, as the risks are so notable.

Download: Information Security Attestation Guide

A Best-Practices Guide to Information Security Attestation

Download our proven Information Security Guide to simplify the process of protecting your data, proving you’re secure and growing your business.

Free Download: A Best Practices Guide to Database Security

Because data is only as secure as the systems & processes it relies on – a holistic approach to data security is essential. This roadmap is not meant to be exhaustive but rather to stimulate the necessary thought process to put you on the path to good data security.

Free Whitepaper: Stop Wasting Money on Penetration Testing

Penetration Testing is most frequently performed to:

• Substantiate the net effectiveness of a mature control environment
• Prove to a third party that an environment is secure/trustworthy
• Quickly assess the security of a less mature control environment (in a sense a technical risk assessment)
• To validate that significant changes did not have unanticipated results