There are more and more organizations interested in a penetration test, or simply a “pentest”, on their infrastructure. However, there is a requirement for specific skills and this expertise is not often available within most organizations. It is also a good idea to have an external opinion, someone who will be impartial and doesn’t know too much about the current configuration. Thus, it is often necessary to hire a security firm to accomplish this task. Unfortunately, there are still many security professionals who are not well qualified to provide this service. It could be intentionally or not. But many clients are easily fooled by consultants, even more when it is a question of IT security mandates. Clients need to be careful and be able to recognize what the report should look like.
Vulnerability Scan != Penetration Test
There are many phases performed during a penetration test. I will describe these phases in more details in an upcoming post. However, it is important to know that there is always an active recognition phase where the professional will use automated tools. For example, Nmap, Nessus, OpenVAS, Nexpose, etc. These tools will allow to scan one or more IP addresses for open ports and well-known vulnerabilities. There are often false positive items in these reports and the professional should validate these findings. For example, a Nessus report. This is an important phase to help the professional to gather information about the target.
The problem is the fact that some security consultant will sell these reports as penetration test. To run vulnerability scans can be a valid service offered by a consultant who will filter findings and rank them according to the exposed risks. However, it cannot be introduced as a penetration test report.
A complete penetration test report will include many other phases. After the previous phase, the security professional will manually look for other vulnerabilities with different methods without the use of automated tools. Finally, the main objective is to retrieve confidential information from the target that someone should not have access and to gain a remote access to the target. To achieve that, the security professional will actually try to exploit vulnerabilities previously found.
Things to look for
Duration
It is not possible to perform a well-done penetration test in only a few hours. Someone told me recently about a consulting firm who consultants will perform two or more penetration test reports during the same day. It is impossible to have great results in these conditions. Obviously, it is often a question of cost. So it is important to validate the duration of a penetration test. It should be in days but always depends also on the scope.
Scope
If there is only one target with no public service running on it, there is not so much someone can do. But probably also worthless to have a penetration test in this context. The line can be thin between a too limited scope where it will not represent what an attacker would have access, and a larger scope where an attacker will lose time on low risk targets. Should it be performed from the Internet or from the internal network? On the other side, if you receive a penetration test report from a third-party vendor, be sure to validate that the included infrastructure and applications are the one that supports the received services.
Expertise
Even a professional with an impressive background in information security is not necessarily the best pentester. I often see job positions related to “ethical hacking” where a certification like the CISSP or even the CISA would be a requirement. No, I don’t have words for that, just, no. If you are really looking for a certification, the best in this field would be the OSCP. But even then, I have it, and I would not recommend myself to perform a penetration test. Why? I did the exam and never practiced anything related to that field afterward. Someone who is passionate about this field and compete at different CTF will be the best one for this task.