Posts RSS
Subscribe via Email
Evolution of Penetration Testing: Part 2
Posted October 13th, 2008 by ian99
In part 1 on this blog I outlined the fact penetration testing evolved from a grey-art practiced by hackers into a more formal process. This evolution has created a bifurcation within “boutique” penetration test service providers.
On the one hand tools-oriented budget firms offer little value added beyond simply running simple vulnerability scans. On the other more profession and experienced firms offer the same tests and scans but also offer analysis that can be offered as direct actionable input into an organization’s existing security governance structure.
The fly in the ointment is that not all security consumers or security organizations are created equally. Some IT security organizations can be characterized a compliance-based. That is to say that they establish and follow a set of rule that they believe will put them on the road to IT security.
On the other hand, most IT security organizations are risk-based and technically oriented. They also follow a formal structure but, addressing risk with the appropriate application of process, procedures, and technology. In graphical terms the situation would appear to line-up as depicted in table 1. Table quadrant 1 representing a weak security organization supported by, “Tool-boys” is noted in red because the risks associated with this coupling. Quadrants 2 and 3 are noted in yellow because of the risks associated with either a weak security organization or weak testing input.
Table 1
|
“Tool-Boys” |
Technical Pen Test Firms |
|
|
Compliance Based Security |
1 |
2 |
|
Technical/Risk-based Security |
3 |
4 |
However, in the real world the table should look more like Table 2. With the increasing acceptance of Compliance-based security models, a set of independently administered vulnerability scans suffices to “check the box” for the requirements for a penetration test. This is good news for these budget “boutique” firms.
Table 2
|
“Tool-Boys” |
Technical Pen Test Firms |
|
|
Compliance Based Security |
1 |
2 |
|
Technical/Risk-based Security |
3 |
4 |
However, as might be expected, it is bad news for IT security in general since all networks live in the same security ecosystem. Market drivers that encourage poor security practices hurt us all.
Hacker Store photo by LatinSuD.
Similar Posts:
Posted in Rants, Technical | 
4 Comments »
Tags: auditor • blog • cashcows • compliance • government • infosec • pen-test • risk • security • tools
October 14th, 2008 at 3:44 am
¿ table1 == table2 ?
October 14th, 2008 at 8:24 am
Heh, bgcolor is having style issues. In table #1, the color schema should be this way:
1: red
2: yellow
3: yellow
4: green
In table #2, it should look thusly:
1: green
2: yellow
3: yellow
4: red
I’ll swap them out with graphics when I have a minute.
October 15th, 2008 at 10:40 am
rybolov,
“Bargain Boutique”? Huh? Only and ex-MI guy come up with that one. Sometimes you say the funniest things.
October 17th, 2008 at 2:13 am
There is more to this story. The burgeoning commercial exploit market is exacerbating the new challenges surfaced by the evolving penetration testing market.
Boutique firms wanting to maximize the assurance they can offer to clients regarding what they can and cant bust through would naturally prefer to have access to all the exploit kits.
http://blog.clearnetsec.com/articles/2007/12/28/%E2%80%9Cbig-money-big-prizes-i-love-it-%E2%80%9D
What I wrote in the blog entry linked above is nearly a year old and more third party packs exists now and more are in development:
http://seclists.org/dailydave/2008/q4/0006.html
So, where does this leave the competent boutique pen testing firms? If we purchase all the kits to maximize our coverage then we lose the competitive bid game hands down. Even if we decide to skip purchasing and we have knowledge of the contents of each of these kits, the time to create reliable exploits independently costs time and money and again places us in a non-competitive bid against the ‘tool-firms’ you mentioned.
I’ve had the opportunity many times to challenge competing firms for pen test projects. If given the opportunity to educate the customer on the differences, then I often prevail knowing I didn’t offer the lowest bid. But that game is getting harder. The price points between ‘tool-firms’ and firms offering greater coverage (by obtaining multiple exploit kits) is widening.
I guess there are two winners here: attackers and ‘tool-firms’.