Upload File

penetration testing training day penetration testing methodology mike westmacott,security consultant...

  • Home
  • Documents
  • Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by
16
Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Upload: annabel-horn

Post on 17-Dec-2015

227 views

Category:

Documents


2 download

Report

Tags:

TRANSCRIPT

Page 1: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Penetration Testing Training Day

Penetration Testing Methodology

Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG

Supported by

Page 2: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

How it used to be

•http://youtu.be/AByemfK_qD4

Page 3: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

The Russian Business Networkis a multi-faceted cybercrime organization,specializing in andin some cases monopolizingpersonal identity theft for resale.

How it is now

Page 4: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 4

Threats and Threats

From BAU•Activities that form part of a business create arisk to the organisation•Internal (process) and external (product)•Threat actor unknown

Specific Threats•APTs

Incident Response•Capture evidence•Document and eliminate threat

Page 5: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 5

APTs – real threats

Page 6: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 6

Incident Response

Page 7: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 7

Hacking As Profession

Legitimacy is keyPermission is essentialDamage is not an objectiveProvide a serviceImprove industry

Page 8: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 8

The Engagement Lifecycle

Client understands they need to gauge riskRequests tenders from consultanciesSelects security providerScope of work is determinedTesting performedReport writtenClient debriefed

Page 9: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 9

Job Scoping

•What risks concern the client?•PII, PCI, reputational…•What assets are there?•How do they fit into to business?

Page 10: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 10

Project Management

Multiple clients, multiple consultantsVaried job locationsClearance requirementsTechnical requirementsCertification requirementsResource allocation is difficult

Page 11: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 11

Testing - Onsite

The fun begins! …. Well…Pre-engagement discussions?Are pre-requisites in place?Where’s the site?Where’s the system?Is it ready to test?Where do I eat?Where are the loos?

Page 12: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 12

Testing - Onsite

Finally! Laptop out :)Stop – look aroundTesting should be discreteCheck the findingsRecord them in a logVerify them againCapture evidenceDon’t get too excited…

Page 13: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 13

Discussing Findings

Softly softly catchy monkeyTake care not to insult anyoneDevelopers take great pride in their workYou may have just destroyed itThey have to fix itNow you’re not friendsAnd you’re there all week

Page 14: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 14

Client Debriefing

Discuss findingsHigh risk issues?Who is attending?Are there process issues?Development problems?Chance to upsell!RetestsSecure code reviews

Page 15: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 15

Report Writing

Write the report whilst testingNever enough timeBe succinctProvide detailed stepsShow evidenceGive recommendationsResearch referencesExecutive summaryIt’s what clients pay for

Page 16: Penetration Testing Training Day Penetration Testing Methodology Mike Westmacott,Security Consultant IRM plc, Chair BCS YPISG Supported by

Presentation to insert name here 16

QA, Delivery, and Closure

Peer review of work producedKey to good qualityJunior staff review firstSenior staff review lastReport is finalised to prevent tamperingIssued securely – sensitive!Ensure records of work are maintained


Penetration Testing - Brown University Departmentcs.brown.edu/cgc/net.secbook/se01/handouts/Ch09-PenetrationTesti… · Penetration Testing 12/7/2010 Penetration Testing 1 What Is

Penetration testing Professional

Penetration Testing Methodologies Testing... · penetration testing, aiutando la comunità di sicurezza nella scelta del percorso migliore per il penetration testing. Il termine open

penetration testing

Writing a Penetration Testing Report - Abaxio · (Sample Penetration Testing Report Black Box Penetration Testing For GPEN.KM V1.0 Month dd th, ... Title Black Box Penetration Testing

Penetration Testing Results

Penetration Testing Report - E-SPIN Group · Penetration Testing Report Independent / 3rd party Web Application Vulnerability & Security Assessment / Penetration Testing / Audit (come

Penetration Testing Network & Perimeter Testing

Penetration Testing Basics

Firewall Penetration Testing

INFORMATION SHEET PENETRATION TESTING...Vulnerability scanning VS penetration testing Penetration testing distinguishes itself from general vulnerability scanning but the two phrases

Web Application Penetration Testing · Penetration Testing By: Frank Coburn & Haris Mahboob. Take Aways Overview of the web app penetration ... §Penetration testing vs vulnerability

Custom Penetration Testing - SANS Sims - Custom... · Advanced Penetration Testing - 2009 SANS 3 What is Penetration Testing? • Process of testing a target environment for weaknesses

Chapter22 Penetration Testing

Penetration Testing Training Day Penetration Testing Tools and Techniques – pt 1 Mike Westmacott, IRM plc Supported by

Penetration Testing Magazine

Wireless Penetration Testing

Cone Penetration Testing

VAPT (Vulnerability Assessment & Penetration Testing) //Remedy · VAPT (Vulnerability Assessment & Penetration Testing) //Remedy A Division. In Penetration Testing, part of a security

Penetration Testing - University of Texas at Dallascsi.utdallas.edu/...Penetration_Testing...Slides.pdf · Penetration Testing. What is penetration testing? Attempt to bypass security

sap penetration testing sap penetration testing - Black Hat

PENETRATION TESTING - Perspective Risk · PDF fileA PROVIDER OF PENETRATION TESTING SERVICES? ... Invariably, penetration testing means that the penetration testers will

Penetration Testing Report

Web Applications Penetration Testingcs1160315/WebPenetration... · 2018. 3. 3. · Penetration testing typically includes network penetration testing and application security testing

PENETRATION TESTING SERVICES - Opposition Security · PENETRATION TESTING SERVICES Opposition Security penetration testing services evaluate your security program in depth to find

Penetration Testing Methodology

Android Penetration Testing

Network Infrastructure Penetration Testing and …...Network Infrastructure Penetration Testing and Ethical Hacking This course teaches penetration testing and will illustrate how

BackTrack 5 Wireless Penetration Testing Beginner's …cdn.ttgtmedia.com/...BackTrack-5-Wireless-Penetration-Testing-eBook... · BackTrack 5 Wireless Penetration Testing Beginner's

Penetration testing demystified

Internal Penetration Testing

Penetration Testing Presentation