Opinion

Penetration testing: man vs machine

We already know that the concept of thinking like a potential hacker is the basis of penetration testing. But merely thinking like a hacker is not enough. We must also act like a hacker. They do not simply rely on their own intuitive genius to breach the systems of target organisations. They use a combination of automated tools and human intelligence to deliver their devastating results. So we must emulate this approach to secure our own defences. It is not a question of man or machine; like the hackers we must use a synergy of both.

When the whole HBO Game of Thrones attack occurred last August Mr Smith of the so-called White Hat Hackers issued a statement which made the point that his organisation invested $400 – $500,000 dollars a year on purchasing automated exploit tools. They then used the information this provided to arm their human hackers with the information required to further develop and exploit the weaknesses they discovered.

So when we at SRM develop a penetration testing strategy we use both automated tools and manual testing to deliver the best results.

Automation has a vital role to play and lays the groundwork for the penetration test. No human can deliver the rapid results that an automated tool can. Imagine yourself in a virtual world. You are in a vast chamber with hundreds of thousands of doors. Malicious hackers can get into your system through a just a handful of these doors but which ones? To identify where the vulnerability lies you must test each and every door; a task which if done manually would be time-consuming and complex. This task can, however, be completed accurately and swiftly through an automated vulnerability scan. Developed by experienced penetration testers, it identifies where the potential vulnerabilities are, putting you are in a position to accurately deploy the next level of attack tool: penetration testing.

To take the analogy a step further, the penetration test, conducted by highly-trained and experienced individuals, then opens the doors that have been identified and explores deep into the underlying infrastructure to examine what is lurking behind them. At the most sophisticated level of penetration testing (Red Team engagement) we then turn that thought process on its head and also test the procedural, social and physical components to replicate the wider view of an attack. Using an adversarial mind set, we think like a motivated hacker and help to develop strategy and policy making which anticipates as yet unconsidered vulnerabilities.

To find out more about the synergy of automated and manual penetration testing, see our pre-recorded webinar in conjunction with AppCheck, our automated tool partner. In this 30 minute webinar which took place on 8th March, Andrew Linn of SRM and James Nelson of AppCheck explain how both man and machine have a role to play in a resilient defence strategy.

To log in to the webinar GDPR: the roles of manual and automated penetration testing, click here.

Or visit our blog:

What is Red Team engagement?

If prevention is to be an achievable goal we cannot rely on static defences

Or see our website Test and Exercise pages.

 

Coinhive attacks and how to prepare for the (almost) inevitable

This week’s report that more than 5,000 websites, including that of the Information Commissioner’s Office (ICO) have been hacked, shows that it really can happen to anyone. Other affected websites where malware took over the processing power of their user’s devices include the Student Loans Company, the council website for Manchester City, Camden and Croydon and the home page of the United States Courts. Although the initial reaction may be one of schadenfreude – pleasure in someone else’s misfortune – a more measured response would be to realise and accept that hackers are now so ingenious and creative that everyone, including those with top class cyber defence, is likely to be subject to attack at some point.

This latest hack involved a piece of cryptocurrency mining malware, called Coinhive, which ran in the background while the webpages of the hacked organisations were open. This forced visitors’ computers to run the mining programme which can then be used to gain small fractions of cryptocurrency from each victim.

So, how can we protect ourselves? The honest answer is that we can’t fully. What we can do, however, is to be prepared for the probability that our systems will be attacked at some point and to reduce the potential impact this will have. Developing a robust Incident Response protocol is an important start and here a Retained Forensic (RF) service will be of immense benefit. With a detailed knowledge of your systems, an RF team is able to mitigate the damage swiftly and effectively.

Damage limitation is crucial but, in the long term, building additional layers of security into your system’s architecture is also key. We need to ensure we are not giving away information without meaning to. We should also consider our defensive architecture but it is important that we balance the need for security with the practical requirement for our systems to be functional and easily navigable.

Achieving this balance is a complex issue. SRM’s VirtualCISO (vCISOtm) service can resource and support the incumbent CISO or DPO in managing this task. From providing expert strategic guidance to taking on the full CISO role, our vCISOtm team has many years’ experience in providing robust yet agile defences. We work with our clients across a range of services including Incident Response, Retained PFI, Digital Forensic Investigation and Security Breach, Incident Management and Containment Support.

To find our more, visit our website or contact Mark Nordstrom on 03450 21 21 51 or mark.nordstrom@srm-solutions.com

If prevention is to be an achievable goal we cannot rely on static defences

SRM is at the PCI London event in London on 25th January, presenting on The Synergy Between Automated and Manual Penetration Testing. 

How a responsive Test and Exercise strategy requires the synergy of both automated and manual testing to keep pace with a constantly evolving threat environment

Prevention is undoubtedly better than cure, particularly in the context of a potentially damaging data breach. In a world where the threat landscape is constantly changing, however, if prevention is to be an achievable goal, we cannot simply rely on static defences. Our defences need to evolve in line with the ever-changing threats and vulnerabilities we face and the only way to identify these is to act counter-intuitively. We need to challenge our own procedures and attack our own defences. If we do not, someone else surely will.

Using these offensive techniques enables us to validate the capability of our existing responses and, even more importantly, identify areas for improvement. A responsive strategic approach to data security requires constantly updated intelligence which can only be provided by a combination of both automated and manual test and exercise tools. Neither is fully effective without the other. The key is the synergy of the two: we cannot mount an effective defence without employing both the speed and rigour of the automated tool and the agility and ingenuity of the human mind. After all, hackers use both so we must too.

Vulnerability testing

The first essential tool in the attack arsenal is the automated vulnerability test. Imagine yourself in a virtual world. You are in a vast chamber with hundreds of thousands of doors. Malicious hackers can get into your system through a just a handful of these doors but which ones? To identify where the vulnerability lies you must test each and every door; a task which if done manually would be time-consuming and complex. This task can, however, be completed accurately and swiftly through an automated vulnerability scan. Developed by experienced penetration testers, this identifies where the potential vulnerabilities are, putting you are in a position to accurately deploy the next level of attack tool: penetration testing.

Penetration testing

A penetration test effectively opens the doors which have been identified in the vulnerability scan and explores deep into the underlying infrastructure to examine what is lurking behind them. Designed to answer the question: ‘What is the real-world effectiveness of my existing security controls against an active, human, skilled attacker?’, it goes to the next level by actively exploiting those vulnerabilities in order to prove (or disprove) real-world attack vectors against an organisation’s IT assets, data, humans, and/or physical security.

More broadly, a full penetration test of an organisations infrastructure utilises the value of automated tests to lay the groundwork at the start of the process. Expert penetration testers will then put themselves into the mind of potential attackers, exploring and exploiting all opportunities. An individual or team of testers are able to think laterally; they can both analyse and synthesise.  As systems become more complex, the ‘attack surface’ continues to grow and the potential number of ways a hacker gains access is ever expanding, making this technique increasingly valuable.

A properly executed penetration test will determine the feasibility of a particular set of attack vectors. It will identify the higher-risk vulnerabilities that result from a combination of lower-risk vulnerabilities exploited in a particular sequence. It will identify vulnerabilities that may be difficult or impossible to detect with automated network or application vulnerability scanning software and will assess the magnitude of potential business and operational impacts of any successful attack.

The scope will be dependent on what the drivers are for the organisation and these will determine the stated goals. These drivers may also influence other aspects of the engagement such as target selection scope, assumptions, and even funding ceilings that limit the amount of time a test team has to explore. Even highly automated, well-resourced, and advanced networks employing sophisticated counter-measure technologies, while useful as part of the testing process, are no match for human intelligence.

Red Team engagement

To continue the analogy of the doors: if pen testing opens the doors to see what is behind them, Red Team engagement goes through the doors and explores the room, the house and the street beyond, getting completely into the mind-set of the potential hacker.

The key difference between a penetration test and Red Team engagement is therefore the extent of the scope. So, while a penetration test is often focused upon a key application or system and is scoped following threat modelling, Red Team engagement is fully bespoke and often ‘goal orientated’. This goal will often be: ‘we have this highly sensitive network/piece of data – can you get access to it?’

The Red Team focuses on the objective of the engagement and examines it from many different angles pulling together a plan of attack using a range of different techniques and abilities. It tests procedural, social and physical components of security in addition to technical controls. Replicating the wider view an actual attack would have, the Red Team uses an adversarial mind set to determine strategy and policy making.

In practice, Red Team engagement involves working with ethical, skilled and experienced professionals who act like true hackers, simulating internal and external hacking attempts to test the response on a client’s system. With client permission, the Red Team seeks to break through the hardened perimeter, using the weakest identifiable point, to gain access to the organisation’s system. Using common hacking techniques, they seek to gain a foothold; tunnelling traffic back through ports that are commonly open within a business, usually via the web, so they can communicate with their own servers on the outside without being detected. These benign servers are then used to control devices, which have either been placed or hacked, on the inside of the client’s organisation.

In addition to a rigorous examination of the organisation’s security controls, Red Team engagement will exercise incident detection, response and management.  This can be linked to a wider incident simulation process testing procedures and response capability throughout the business.

Opening up an organisation’s entire network and allowing a third party to effectively breach security defences requires a high degree of trust. Experienced, highly qualified Red Teams are few and far between. At SRM our Red Team is comprised of ex-police High Tech Crime Unit officers, qualified ethical hackers and includes holders of the Offensive Security Certified Professional (OSCP) the world’s first completely hands-on offensive information security certification. OSCP challenges students to prove they have a clear and practical understanding of the penetration testing process and life-cycle through an arduous twenty-four (24) hour certification exam.

When you combine the benefits of a best in class web vulnerability scanner updated within hours of new threats emerging, able to be run ‘on demand’ and OSCP trained experienced penetration testers it’s a powerful combination to help stay safe in today’s ever-changing world of cyber threats.

Conclusion

There is no one-size-fits-all solution. The importance of accurate scoping at the outset of the exercise cannot be overemphasised because every organisation faces its own unique challenges in terms of regulations, risks and vulnerabilities. What is more, in a world where data security is constantly evolving in response to new and ever more ingenious attacks, an organisation’s test and exercise strategy needs to reflect this. If your incumbent data security provider cannot demonstrate the required agility, you must ask yourself whether your requirements are being met.

SRM partners with industry-leading vulnerability scan provider AppCheck to deliver both the automated and manual elements of a bespoke test and exercise strategy. SRM can advise on all aspects of Information Security Testing as well as providing a full range of consultancy services. For further information please contact Mark Nordstrom at mark.nordstrom@srm-solutions.com  or phone 03450 21 21 51.

GDPR: the world will not stand still on 25th May 2018

The 25th May 2018 is not an end date. Far from it. It marks the beginning of a new era in data protection but one that will continue to evolve as our online world continues to develop. So, although organisations will be required to be compliant with the General Data Protection Regulation (GDPR) from that date, it is an ongoing process, not Armageddon.

In the words of the ICO’s Information Commissioner Elizabeth Denham: ‘It’s an evolutionary process for organisations – 25 May is the date the legislation takes effect but no business stands still. You will be expected to continue to identify and address emerging privacy and security risks in the weeks, months and years beyond May 2018.’

For organisations with GDPR firmly on their radar it seems primary focus is on reaching a level of compliance come GDPR Day 1, but about Day 2 and beyond? Those who are fully compliant by 25th May will need to work hard to remain compliant. Those who are not yet completely ready will need to work even harder to reach and maintain compliance or risk substantial fines. The key factor to remember, however, is that it will be nigh on impossible to achieve perfect maintenance of absolute compliance. So, take comfort from the fact that the ICO has stated that those who are able to demonstrate that appropriate systems and thinking are in place will find that the ICO takes this into account when they consider any regulatory action.

So, while absolute compliance may be an intended aim, what organisations really need to focus on is the fact that they can demonstrate the thinking and the steps they have taken to be compliant. That is not to say that anyone will get ‘A’ for effort if no practical steps have been taken.

As Elizabeth Denham explains, there is no excuse when it comes to GDPR: ‘’There will be no ‘grace’ period – there has been two years to prepare and we will be regulating from this date…We all know what’s coming. It’s a known known. Much of the GDPR builds on the existing Data Protection Act 1998. There’s also guidance and a lot of help out there…

SRM’s GDPR team provides a business-focused service to organisations of all types and size, at all ends of the GDPR-readiness spectrum. While we provide unrivalled technical and compliance expertise, we also understand how businesses operate, working with clients in the GDPR compliance process with the focus on delivering robust, efficient and effective on-going compliance, not on selling products.

SRM has operated in this environment for many years. Our GDPR consultants are trained through a GCHQ-approved qualification and are able to advise on the strategic management of GDPR compliance. We can also take on the full Chief Information Security Officer (CISO) or Data Protection Officer (DPO) roles in either traditional part time roles or via our VirtualCISOtm.

VirtualCISOtm is proving a popular option for businesses which require broad levels of expertise to complement existing skill sets and roles in a flexible manner.

To find out where you are in terms of GDPR readiness, complete our free online GDPR Self Assessment Questionnaire.

To find out more about what SRM’s GDPR can do for you, contact Mark Nordstrom (mark.nordstrom@srm-solutions.com) or 03450 21 21 5https://blog.srm-solutions.com/are-you-ready-for-gdpr/1 or check out our website.

 

Or read our blog:

GDPR: a question of confidence

GDPR has been developed to protect us from breaches like Uber

After GDPR what will happen to ICO notification fees?

 

 

The global growth of the eDiscovery market

The global eDiscovery market is forecast to rise from $6,000 million in 2016 to $13,000 million by 2023. Law firms across the world are therefore increasingly looking to develop their eDiscovery services to retain their competitive edge in this market and provide a valuable service to win and retain clients.

The ‘Global eDiscovery Market Analysis and Forecast to 2023’ by Research and Markets attributes this growth to several factors. Firstly to the rise of electronically stored information (ESI) and the increase in the number of litigation cases. Secondly, the researchers cite the continuous drive to bring down the functional costs of legal departments, the necessity to comply with rules and regulations and the increased usage of mobile devices.

Although North America accounts for 65 per cent of the global eDiscovery revenue in 2016, other geographical areas are predicted to experience increased growth in coming years. In the UK, eDiscovery is comparatively well-developed compared to other parts of the world, with many now working with established eDiscovery providers to deliver a seamless, professional and cost-effective service to their clients.

This trend is due largely to the significant cost of purchasing an eDiscovery platform and the vast technological and forensic resource required to deliver the service in-house. A managed eDiscovery service combines the technical skills and experience of a specialist team working in partnership with the legal team. In addition to providing the tools required to discover relevant ESI, a full eDiscovery Managed Service provides the expertise to manage all elements of the process, including case management, all pre-processing, searching and filtering data for relevance, the redaction of files and the reduction of the sheer volume of data which meets the ultimate test of court acceptance.

SRM first began developing its eDiscovery service in 2002 and its team includes experts drawn from law enforcement, government agencies and military with over 60 years’ combined experience. The team has delivered thousands of cases supporting law firms, government agencies and commercial organisations in the accurate production of case papers and reports to be tendered in court. Through SRM’s managed service, law firms benefit from working with this reputable team while also having affordable access to Relativity, the market leading eDiscovery review and collaboration platform.
For a free demonstration and introduction to the SRM eDiscovery Managed Service please contact Mark Nordstrom at SRM: mark.nordstrom@srm-solutions.com or telephone 03450 21 21 51.

See our website: eDiscovery

 

Or visit our blog:

eDiscovery: the issues facing law firms and solicitors

eDiscovery and eDisclosure: why, what, how and who?

 

 

SRM Blog