With the increasing volume of malicious files being detected and the number of attacks growing year after year, it seems that today’s cyber attackers are winning.
While cyber professionals cannot completely stop cyber attackers from trying, the damage caused can definitely be mitigated. Unfortunately, in this scenario, many organizations are implementing mitigation actions based only on gut-reactions instead of an organized and proactive response process. This results in organizations failing to properly respond to these attacks.
Plan to Respond
Despite the huge number of cyber-attack incidents in the world today, some organizations still do not give it the importance it warrants. They fail to patch their vulnerabilities, and choose instead to focus more on short-term bottom-line responses without worrying about the long-term consequences of the immense damage issued out by these attacks.
This will not only result in the organization spending more resources toward clean-up activities but also in the loss of reputation that may seriously affect the progression of their development and growth. Today, organizations must simply put in more resources into cyber security activities within the sphere of their control.
Recent studies indicate that only 30 percent of the organizations conduct full-network active vulnerability scans less often than on a quarterly basis, and less than 60 percent run vulnerability scans on a monthly basis. These numbers are simply unacceptable. Adding to the situation is the poor employee security awareness training programs within organizations. It seems that employees are simply doing enough to keep their jobs, acting as passive cogs in the machine. Even as phishing attacks, malware, and zero-day attacks continue to grow, employees are not trained enough to be able to recognize the telltale signs of these threats.
The Way Forward
Adequate awareness and training programs help in reducing the number of successful data breaches. When the mobile factor is taken into consideration, the scope of threats and vulnerabilities go up to an even higher level. Mobile devices such as smartphones and tablets are the weakest IT security links today. Organizations seem to be struggling to defend themselves against threats on mobile devices. Mobile device management (MDM) and mobile application management (MAM) are the most commonly cited mobile security technologies being budgeted for in 2015 for implementation.
Organizations must allocate the necessary funds and resources toward their IT security budget and rethink overall strategies and training development. This not only helps protect data security but also preserves an organization’s reputation and helps them stay in the business.
Penetration Testing is the Tool to Help Win the War
Organizations, especially large consumer corporations, should perform penetration testing. It is a process of testing corporate applications for vulnerabilities to check the preparedness of the company in the event of a hacker attack.
Penetration Testing has many definitions
- “A penetration test is a software attack on a computer system that looks for security weaknesses, potentially gaining access to the computer’s features and data,” according to Kevin M. Henry’s “Penetration Testing: Protecting Networks and Systems.”
- “A penetration test can determine how a system reacts to an attack, whether or not a system’s defenses can be breached, and what information can be acquired from the system,” according to “The CISSP® and CAPCM Prep Guide: Platinum Edition.”
- “Penetration testing is the process of attempting to gain access to resources without knowledge of usernames, passwords, and other normal means of access. If the focus is on computer resources, then examples of a successful penetration would be obtaining or subverting confidential documents, pricelists, databases, and other protected information,” according to Sans Institute.
Why Conduct Penetration Tests
There are many reasons for an organization to conduct a penetration test. Not only does it help determine if the infrastructure is impenetrable, it also enables the organization to identify the weaknesses before an attacker does.
Penetration testing helps organizations find critical vulnerabilities within corporate web applications. Penetration tests are a proactive way for organizations to go on the offensive, rather than just waiting for hackers to penetrate their network. These tests provide the real experience of dealing with intrusions and understanding the protocols that must be followed. In order to thoroughly check if security policies are truly effective, penetration tests must be conducted without informing the staff. It is the equivalent of a fire drill, enabling businesses to uncover corporate vulnerabilities. These tests are only as effective as the follow-up processes that are put in place to address any potential vulnerabilities.
Effective penetration tests involve bringing together a team of skilled hackers to test corporate applications for vulnerabilities. Organizations can then set up a process test to see if the team of hackers can gain entry into their systems. The tests can be administered on IP address ranges, individual applications, or with even just the company name. It is important that the corporate security team has a game plan for the penetration test. The level of access for these tests need to be determined and prepared ahead of time to check exactly what is being monitored. There must be scheduled meetings to discuss the scope and objectives of the penetration tests, and only the corporate security team must be notified of the exact time of the tests for maximum effectiveness.
Penetration Test Best Practices
Some best practices include:
- Hiring penetration testing teams who are unfamiliar with the system, and allowing them to attempt to gain access into select corporate systems.
- Following the OWASP Top 10 provides an annual list of the 10 most critical web application security risks which is a world accepted standard.
- Social engineering (e.g. asking employees to take a look into the computer room to run safety checks and install USB key-loggers). Giving penetration testers access to a version of a web application that has not yet been deployed with instructions to gain access or cause damage by any means possible. The team of penetration testers will then execute a range of different attack methods against various parts of the application in an attempt to break in.
Penetration tests need to have clear, focused objectives. Companies need to utilize penetration tests to continuously improve their security systems. The purpose of a penetration test is to identify key weaknesses in corporate systems and applications, in order to determine specific plans to best allocate resources to improve the security of corporate applications.
Penetration Testing Approaches
There are two main approaches to penetration testing:
1. External Approach – tests if anyone from outside the organization can get into the infrastructure.
2. Internal Approach – tests if employees can gain access to unauthorized areas
Types of Penetration Tests
- Client-side test: This test can find vulnerabilities and exploit Web browsers, editing programs, and more
- Network services test: This test can be done remotely to see what can be accessed, or internally to see how much a disgruntled employee with good skills can access
- Remote dial-up war dial: This test is used to test modems and is done via countless guessing of passwords or by logging into connected systems using brute force
- Social engineering test: This test is done by persuading or convincing someone to give out confidential information. For instance, a penetration tester calls the secretary asking for the manager’s password stating a reason.
- Web application test: This test is used to find vulnerabilities
Summary
Penetration testing is only one of the ways to help with combating attackers, but nevertheless, it is a good process. Companies need to ensure that these tests are conducted on a periodic basis and must also develop appropriate strategies to fix the vulnerabilities that have been identified.
Michael C. Redmond, PhD, MBCP, FBCI, CEM, PMP, ISO 27001, ISO 27035, ISO 27035, ISO 22301, ISO 21500 and ISO 41001 Certified, PECB Certified Instructor, retired major (US Army), is CEO and lead consultant for Redmond Worldwide www.redmondworldwide.com. Dr. Redmond is an international consultant, speaker, author, and trainer. She has helped international organizations create great Cyber Incident Response (CSIRT) programs, plans, and playbooks; security information and event management (SIEM) programs; and compliance programs. Redmond has two books coming out this year on cyber security and business continuity. Redmond has “BASIC CYBER SECURITY” audio training series and workbook available at www.rwknowledge.com which Disaster Resource Guide grants six continuing education units. Her LinkedIn profile is https://www.linkedin.com/in/michaelredmond2008.
Vibhav Agarwal is senior manager of product marketing at MetricStream. Agarwal has more than 12 years of progressive experience in cybersecurity and business resilience product marketing, cloud-based enterprise software deployment and vendor selection across hi-tech, trading, capital markets, and Internet domains.
