-: Penetration testing.
So, the next thing we're gonna talk about
in this series is penetration testing
and the phases that go along with it.
But first we have to answer the question of,
what is penetration testing?
Well, a penetration test, also know as a PenTest,
is gonna simulate what a cyber attacker
is gonna do to your network.
So, most of the time, this will happen
such as a red-teaming event, where they're gonna simulate
being the bad guy and try to break into your network.
They do this by using the same types
of information, the same types of software,
and the same types of techniques
that an attack would actually use on your network.
Now, the goal here is for that attacker
to gain access to your systems, and then
give you a a full report, an itemized report
that's prioritized of all the things that you should fix.
Now, will a PenTest find every hole
and every vulnerability in your network?
Well, no, that's not their goal.
Their goal is to find at least one way
into your network, or maybe two or three.
That's the difference between doing a PenTest,
which is taking an outside-in approach to cyber security,
versus using something like a vulnerability
management scan, which takes an inside-out.
When you do a vulnerability management scan,
you're gonna see all of the things you're missing,
and all of the holes, that you can see
from the inside with knowledge of your network.
In a PenTest, it's coming from the outside-in,
and you're gonna see what the attacker is gonna see.
So when you do a PenTest, who is gonna do it?
Well, there's a couple of people who can do this.
First, this is gonna be performed by either
internal staff or external consultants.
For example, the organization I work for,
we have our own dedicated red team.
This is a group of 30 or 40 people,
and they conduct these penetration tests
for us, across all of our networks
around the world, and then report back to us.
That's one way of doing it.
The other way, if you're a smaller organization,
is to hire a red-teaming firm or a PenTesting firm.
And you would hire these highly-skilled individuals
to come in on a one-time basis,
through the year, and come do that test.
That way, they're not doing just your company,
but they're doing lots of companies,
and they spread that cost among all the companies.
Now, these tests are very time-consuming
and they can be very costly.
So, you have to consider when is the best time
to do it, and when you want to use it
and get the information back into your system,
and take action on those results you find.
So when we talk about a PenTest,
there's a couple of different phases we have to know.
The first phase and the most important phase is planning.
You have to plan the PenTest, and as the PenTester,
you have to plan your attacks.
So when I'm going on a PenTest, I'm gonna start thinking,
okay, what open-source environment
and information is out there?
I'll do things like looking at fingerprinting
and open-source reconnaissance,
I'll be looking at news articles,
I'll be looking at resumes, I'll be looking
at all these things that I can do to discover
what vulnerabilities are out there,
which gets us into the discovery phase.
Now, once I have a good idea of what
vulnerabilities are in that network,
I'll actually launch my attack.
And when I launch my attack, I may get
a foothold into the network, or I'll not get the foothold.
And if I don't, then I have to back and do
more discovery to find another way in.
Now, even if I am successful and I get in,
I'm now on the inside of the network,
I'm going to do more discover to find out
what else is vulnerable inside the network.
And so you'll see there's that little loop
there between discovery and attack and attack and discovery,
where you'll go through that loop several times.
At the end of all of this, you're gonna go ahead
and report what you found in an itemized method.
And once you give that to the management,
they may decide, hey, let's plan another PenTesting attack,
and we'll do it again next year.
And so this is a big cycle that happens over and over again.
Now, this particular image you're seeing comes from
the NIST Special Publication 800-115,
which is the Technical Guidelines for
Information Security Testing and Assessment,
which really is talking about how you're gonna
do a Penetration Test into these four phases.
Now, if you take Certified Ethical Hacker,
or some of the other certifications,
they don't go by this four-phase model,
they go by a seven-phase model,
which just breaks out planning into two or three pieces,
and discovery into a couple of pieces,
and attack into a couple of pieces,
extending that process over seven phases, as opposed to
these standard four phases you see here on the screen.
Now, when we talk about planning,
this is an important part of the PenTest.
No technical work is performed,
it's all about the timing, the scope, and the authorization
that's gained during the planning phase.
You're never gonna conduct a PenTest without authorization
because that's considered illegal.
That's considered computer hacking, and you can
actually go to jail for that.
So never touch a network without having
a signed scope of work and contract in place.
That all happens during the planning.
Now, during this, you can do some open-source
reconnaissance work and things like that,
but you're never gonna touch the network.
Now, once you go into the discovery phase,
this is where we conduct more obtrusive reconnaissance,
and we're gonna gather as much information as possible
on the network, the systems, the users,
the applications, all of this stuff.
We'll use the open-source research again,
we'll use port scanning, enumeration,
vulnerability scanning, and web application scanning
just to name a few as we try to start using
technical and non-technical methods
to figure out what this network is, and what
our best way in for the attack is gonna be.
Now we move into the attack phase.
This is where we're gonna try to bypass the security
controls and gain access into this victim system.
Now this is the exploitation phase, right?
It's called the Attack Phase under NIST,
a lot of other places will call it exploitation
because you're performing the exploit.
This is where you're gonna gain access,
you're gonna try to escalate your privileges
to get administrative rights,
you're gonna try to browse from system to system,
and do additional discovery, so if I get in
on a user system, I now wanna see
how I can really pad over to a server,
or over to an administrator-user of computer,
something of that nature.
And we're gonna install additional tools,
again, all of these things are the way
that they call it in this Special Publication
from NIST 800-115, but if you go through
other Ethical Hacking classes, like CEH,
or if you start going into CASP or you go into CISSP,
they will call these phases different things,
but it's the same basic premise.
You're gonna plan, you're gonna discover,
and then you're gonna attack.
Now that you're done attacking,
we're going to report back on what we found.
The tester needs to prepare a detailed
report after the test.
This report can be 50, 100, 150 pages sometimes,
depending on the test you conducted.
The results of this PenTest are all gonna
be documented, they're gonna document their successes,
what they were able to break into,
and they're gonna document things
they were not able to break into.
So say, hey, I was able to get into your Windows server,
but I couldn't get into your Linux server.
And they're gonna also give you
suggestions on how to fix them.
Now, when you have these suggestions,
you want to rank them, in priority order.
So let's say you found 50 things that were wrong.
Well, if you only had money to fix one of them,
what's the most important?
That's number one.
What if you had two?
Well, number two.
And so on, all the way down the list,
what is the most critical, then go into your highs,
then your mediums, then into your lows.
That helps the organization make
a judgment call and a risk decision
on what to fix first, and where to allocate resources.
That is probably the most important thing
to get benefit from the PenTest,
is to have that itemized report at the end,
because if you run PenTests and never fix them,
fix the things you find, then you're wasting your money,
and these PenTests are very expensive,
so you wanna make sure that you know
exactly what you're getting out of it,
and you take action on those.
And that's the overview of PenTesting,
or Penetration Testing.
Remember, four phases, right?
Planning, discovery, attack, and then reporting.
If you do those four phases, you'll do fine
inside the exam.