Category: Risk Management

Posted on

Expand Your Concept of Penetration Testing

Penetration testing, or ethical hacking, is the process of using tools and techniques used by attackers to exploit vulnerabilities and reach information resource targets.  This article at the InfoSec Institute provides a description of the top tools used for this.

Penetration tests are performed in two ways: during the testing phase of the SDLC and annually after implementation.  Most organizations do not have the resources to pen test during the SDLC, nor can they afford to have a pen tester on staff.  This requires engaging a third-party to perform these tests as part of an annual external review of security effectiveness.

Testers do not arbitrarily start attacking systems.  They perform tests approved by management in writing.  In addition to the tests to be performed, the test approval documentation should include test boundaries.  For example, management might require the test to end once vulnerabilities are discovered without actually accessing sensitive data or adversely affecting production systems.

In the past, attacks stepped through the traditional attack steps, including

  1. Reconnaissance
  2. Scanning
  3. Gaining access
  4. Maintaining access
  5. Covering tracks

These steps are used to crack through perimeter defenses.  However, most attacks today bypass the perimeter and leverage user vulnerabilities to enter our networks.  Consequently, penetration tests must include attempts to use tools and techniques, including social engineering.

In addition to paying for formal pen tests, bug bounty programs are a good way to get hundreds or thousands of people looking for weaknesses instead of one or two.  One company that coordinates these is https://www.bugcrowd.com/.  Bug bounty programs aren’t just for Microsoft and Google.  They are for businesses of any size that want the maximum number of eyes looking for weaknesses in websites or applications.

Would you recommend a bug bounty program for your organization in addition to or instead of a pen test?  Why or why not?

Posted on

Some courts making ‘it might happen’ grounds for litigation

The U.S. appeals courts are split on whether the simple perception or belief that stolen data might be used is grounds for litigation.

A recent federal appeals court ruling in a putative class action lawsuit that says plaintiffs can sue even if there is only fear of, but no actual, damage from a data breach further deepens an appeals court split on the issue and enhances its chances of being considered by the U.S. Supreme Court, experts say (Greenwald, 2017)

This is interesting and concerning.  All organizations are vulnerabile to an attack.  No security framework is perfect.  Prevention, detection, and response are all important actions taken by diligent organizations, so how these are implemented and conducted should be considered.  Juries and judges are likely not to understand this.

I agree that negligence should is grounds for litigation.  However, no organization that promptly and effectively responds to a breach should not be held liable.  Thoughts?

 

 

Posted on

“Security in depth is spending in depth”

It’s always a good idea to understand our current controls and how they work together.  We must also fully utilize each control.  This is becoming something expected by business managers during budget time.  Dawn Kawamoto writes,

One possible contributor to tight security budgets and tempered growth in the industry is a desire by companies to achieve greater efficiencies with their existing technology. “Rather than spending more on security, boards are asking ‘what are you doing to spend less and do it in a better way than what we are doing?'” Pescatore says. “Security in depth is spending in depth.”

I wrote about this several years ago.  Using a controls matrix, it’s easy to start bringing together the information we need to optimize each control and more effectively manage risk.