A large proportion of attacks on businesses start with hacked computers or employee accounts that are in the familiar office environment. Sometimes an employee accidentally installs something or his or her account is compromised. In addition, servers may be attacked on-site. To test what might happen if this scenario occurs, it is necessary to place a computer within the network. Previously, NFIR’s ethical hackers would physically come to your office location for this; today, this is done remotely with a pen test box.
What's the PentestBox?
The pentest box is a computer the size of a small breadbox that NFIR sends by parcel post. The box contains common tools that are also used by malicious hackers in practice. This computer is placed on the network by your administrator. Then NFIR’s ethical hackers log in here. They do this entirely remotely. This mobile mode of operation makes a grey box infrastructure pentest much more effective. There is no or less travel time, no need for space to be provided and also no need for anyone to remain on site to receive and supervise the ethical hackers. For the physical aspects of a grey box infrastructure pen test, such as testing your Wifi, printers or badge system, the ethical hackers do, of course, come on site. Often this is a visit of one or a few days.
Is it safe to place the pentest box in a network?
The premise of any pen test is that the ethical hackers always try to have as little impact as possible on the environment being tested. The same principle applies to the use of the pentest box. It will be set up so that its use is safe. The pentest box contains an installation of Ubuntu 22.04 LTS Server, which is configured and kept up-to-date using Ansible. Both Ubuntu and Ansible are respected tools in the industry. To connect to your network, the pentest box connects to a Wireguard VPN from NFIR. Only pentest boxes and NFIR’s ethical hackers have access to this VPN. Other office staff and NFIR services reside in other VPNs that reside on physically different servers. Malicious actors with access to the pentest box’s network connection also encounter strong security. The services on the pentest box are only available through the VPN, and high standards are also used within the VPN. The ethical hackers connect via SSH with public-key authentication and the other services use random passwords of at least 20 characters. All these measures guarantee secure use of the pentest box.
To what extent is your homework facility technically resilient to hackers?
During a grey box infrastructure pen test, very sensitive data is often encountered. All output from the hacking tools on the pentest box is stored in a highly encrypted portion of the SSD (hard drive) in the pentest box. To do this, NFIR uses LUKS encryption with a 40-character key. The entire installation of the operating system, Ubuntu Server, can be rolled back to the state before starting the pentest box. This prevents information from ending up in system logs. After the pentest is completed, the remote pentest box is cleaned up. Important evidence is copied, then all data is removed from the encrypted part. Then NFIR restores the installation to the state before the pen test. In this way, it is possible to return the pentest box safely by parcel post.
What is the difference between a pentest and a vulnerability scan
A vulnerability scan uses automated scans to discover known vulnerabilities. These vulnerabilities are then reported. It is an important first step in understanding potential weaknesses within a system.
A pen test goes one step further. During a pen test, not only are vulnerabilities identified, but they are actually exploited. This demonstrates what the actual consequence may be to a system or environment when compromised. The ethical hacker will use his experience and creativity to identify all the weaknesses of an environment, giving the organization a more realistic picture of the risks they face.
Penetration test or vulnerability assessment? – Have a Pentest Performed – Contact NFIR Now
How long does a Pentest take?
Depending on the size of the job, a careful assessment is made as to whether multiple people should be put on a pen test to reduce the length of the job. The duration of a pen test can vary depending on the environment being tested and the complexity of the attack scenarios being used. Generally, a pen test covers a period of 2 to 4 weeks. This period includes not only the execution of the test itself, but also the preparation, analysis and explanation of the final report.
When is a Pentest necessary?
A pen test (penetration test) is necessary because companies are often unaware of vulnerabilities in their network and systems. It is a controlled and authorized attempt to evaluate security through a simulated attack. The main reasons for a pen test include vulnerability identification, risk management, regulatory compliance, evaluation of new applications and changes, protection of customer data, and building trust with customers and stakeholders. Conducting regular pen tests is essential to improve security and prepare for potential attacks.
- For example, a pen test is useful to:
Assessing your current situation for vulnerabilities. - Detect vulnerabilities before the release of new applications.
- Check weaknesses after changes to infrastructure or applications.
- Comply with corporate policies, standards and/or legislation that require periodic security assessments.
- Test your Cybersecurity maturity against the detection methods you have implemented.
What methodologies and standards are used during the execution of a Pentest?
When performing a pen test, various international standards and methodologies are used to discover and classify vulnerabilities.
Some of the key standards applicable to the assignment include:
- Penetration Testing Execution Standard (PTES): methodology for the purpose of infrastructure pen testing.
- OWASP WSTG: Standard for the purpose of Web application pen testing.
- OWASP Top 10: The 10 most critical web application vulnerabilities.
- OWASP API Security Top 10: The 10 most critical API vulnerabilities.
- OWASP MASTG: Standard for the purpose of mobile application pen testing.
- Common Vulnerability Scoring System (CVSS): Used to classify the severity of vulnerabilities.
By using these standards, a pen test can be performed in a structured and thorough manner, and the results can be reported in a clear and comparable way.
Penetration tests by our certified experts
Our pen testers have a large amount of experience, a lot of creativity and up-to-date expertise. The NFIR pen testers have followed relevant training courses and obtained certifications such as OSCP. In addition, they have all received chief of police approval and signed confidentiality agreements.
Black box or white box scenario?
A Black Box pentest means that no information about the environment is shared with the pen testers beforehand. With a pentest based on the White Box principle, all information about the environment is shared in advance. If you are having a pen test performed for the first time and want to get an overall picture of your security, it is useful to have a Black Box pen test performed.
What do OWASP WSTG and OWASP MASTG stand for?
- OWASP WSTG
The Web Security Testing Guide (WSTG) project is the premier cybersecurity testing resource for Web application developers and security professionals. The WSTG is a comprehensive guide to testing the security of Web applications and Web services. Created through the combined efforts of cybersecurity professionals and dedicated volunteers, the WSTG provides a framework of best practices used by penetration testers and organizations around the world.
- OWASP MASTG
The OWASP Mobile Application Security Testing guide is a mobile app security standard and comprehensive testing guide that covers the processes, techniques and tools used during a mobile app security test, as well as a comprehensive set of test cases that allow testers to deliver consistent and complete results.
What does the PTES standard stand for?
The Penetration Testing Execution Standard (PTES) consists of several main components. These cover everything about a penetration test, namely:
- The initial communication and reasoning behind a pen test;
- The information gathering and threat modelling phases, where testers work behind the scenes to gain a better understanding of the tested organisation;
- Vulnerability assessment, exploitation and post-exploitation, which addresses the technical security expertise of the testers and combines it with the business acumen of the assignment;
- Reporting, which captures the entire process in a way that makes sense to the customer and provides them with the most value.
What does the CVSS standard stand for?
The Common Vulnerability Scoring System (CVSS) standard provides an open framework for disclosing the characteristics and consequences of software and hardware security vulnerabilities. The quantitative model is designed to ensure consistent and accurate measurement while allowing users to see the underlying vulnerability characteristics used to generate the scores.
