Why is penetration testing important?
You can’t fix what you don’t know is broken.
Discovering a leak only when some unauthorized visitor has taken advantage of it sucks.
Ask anyone who’s gone through it. Hackers might have slipped into your network to snoop around, nab confidential information and/or cause havoc…Whatever the case, this is most definitely a situation that is better avoided.
At USENIX Enigma 2016, NSA TAO Chief Rob Joyce presented Disrupting Nation State Hackers. In this talk, he underlines the importance of knowing your network:
“You‘d be surprised…about the things that are running on a network versus the things you think are supposed to be there. So what can you do to understand that exposure surface? RED team that network. Bring in pen testers. Poke and prod it, just like an adversary will do to find out what’s inside that space.”
Watch his presentation here:
Why seek help outside your organization?
In the same way that even the finest authors have copywriters and editors, external penetration testing gurus not only bring fresh eyes to a project, they are also completely unburdened by the many complexities that can exist within an organization. Combined with a dedicated expertise with the latest tools and approaches to really see under the hood, reputed penetration testing experts can much more easily identify and rectify those seemingly invisible problems lurking in your network.
What to look for in penetration testing experts
Sadly, there is no one-size-fits-all when it comes to penetration testing.
Sure, adopting a hacker’s perspective when reviewing your infrastructure is vital, but so is the employed methodology. At the most general level, it ought to include target identification, foot printing, as well as server and service identification.
Once detailed port and vulnerability scans are conducted, a good penetration testing team would select specific tools for the job, depending on the network setup, IT use cases and the aforementioned business goals.
In other words, a good penetration tester needs many years of experience and an up-to-date toolbox to tailor an approach befitting a specific organization, so make sure they have the credentials for the job before you hire by asking for recommendations, testimonials, and use cases.
What TBG Security can offer
TBG Security believes in a phased approach to vulnerability management and penetration testing. We have perfected our methodology over many years and have come up with this approach which is flexible yet comprehensive.
We begin by identifying hosts to be included in our target of evaluation. Sometimes this information is provided upfront. Other times, we must use technical means to discern the addresses of live hosts to test.
Once we have a detailed list of targets, we will port scan them to identify available services on each target.
We then feed results from the enumeration step into our commercial vulnerability scanner and perform an automated vulnerability assessment with no impact to the operating environment where the targets are housed.
At this point, we perform automated and manual penetration testing. We’ll leverage information already gleaned through the vulnerability scans, our operational knowledge of the environment we are working in, common manual hacking techniques and the use of many additional tools (both open source and commercial) to attempt actual exploitation of known or perceived vulnerabilities.
Depending on the findings, the network configuration and the business, we may recommend a deep-dive penetration test against individual applications where added diligence is warranted or required. An application penetration test takes a more detailed look at the systems, architecture, and workflow of the application being tested.
Find out more about penetration testing.
TBG Security is a leading provider of information security and risk management solutions for Fortune 100 and Fortune 500 companies. TBG designs and delivers cyber security solutions to work in harmony with existing operations. Companies depend on TBG services in areas including risk management, penetration testing, security policy development, security strategies for compliance, business continuity, network security, managed services, software and service integration and incident response.
For more information on how TBG Security can help your organization with your information security initiatives please visit https://tbgsecurity.com.