6

I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us. In the past, we've already mandated penetration testing from two independent companies specialized in this area (Dionach and GSS). We've also run some automated penetration tests using Nessus.

Those two auditors were given a lot of insider information, and found almost nothing* ...

While it feels comfortable to think our system is perfectly secure (and it was surely comfortable to show those reports to our clients when they performed their due diligence work), I've got a hard time believing that we've achieved a perfectly secure system, especially considering that we have no security specialist in our company (Security has always been a concern, and we're completely paranoid, which helps, but that's far as it goes!)

If hackers can hack into companies that probably employ at least a few people whose sole task is to ensure their data stays private, surely they could hack into our small business, right?

Does someone have any experience in hiring an "ethical hacker"? How to find one? How much would it cost?


*The only recommendation they made us was to upgrade our remote desktop protocols on two windows servers, which they were able to access only because we gave them the correct non-standard port and whitelisted their IP address.

3
  • 6
    Why do you have a hard time accepting the report from the people you have now? If you have a good report from a 'ethical hacker' will you accept it or will you just worry that you need to hire 'better' hackers? it's good that you care about this stuff but you can sometimes be a little too worried.
    – Rob Moir
    Jun 21, 2011 at 5:22
  • 5
    one thing to consider is that just because youre small does not always mean you are an easy target. The size and scale of say, sony's infrastructure makes it an almost impossible task to keep every public facing system patched and as secure as needed with the amount of custom code running on them. There will be more ways into these companies than a small company with one webserver that's patched to the eyeballs.
    – Sirex
    Jun 21, 2011 at 6:56
  • On topic for Security.stackexchange.com
    – Rory Alsop
    Jun 22, 2011 at 9:05

9 Answers 9

8

Its good that you are thinking about being secure, but there is no such thing as a "sure system". Modern security practice involves isolating servers so breaches are contained rather than prevented. All webservers and other remotely accessible servers should be placed in an isolated DMZ that has only a limited subset of data (i.e. - as little as possible to perform the task at hand).

The best security advice is to act and plan as if servers with remotely accessible services are already compromised. For internal data, secure your most important assets so only the people who have a job role that requires them to access them can access them and there is no way for them to access the data off-site or to download it all onto a USB key.

Security is a cost-benefit equation, it is very costly to setup secure systems and you should only add additional security measures when they are required. Setting up retina scanners, man-traps, keypads and so forth to get into your office would be a waste of money unless there is something inside that you really need to be paranoid about. Spending money on security to try and reduce your "feeling" of paranoia, is not good spending. Spend it on the risk that you will be hacked and the impact if you are.

Do the best-effort stuff with your services: as few ports open as possible with as few services. Keep them up-to-date. Follow security mailing lists and bug-reports about the software you are running. Read "hardening" guides for webservers.

It is generally more cost-effective to focus on isolation and detection that prevention. IDS products or log analysers can be really useful here.

6

The majority of my work is for a company that NEEDS very high levels of security and has the wherewithal to achieve that. As such they have "white hats" and "black hats", the former are employees who design, implement and test within limits the security systems. The latter are external guys who are reformed crackers, some with criminal records, almost all are significantly involved in open-source code projects with a security angle. The two teams absolutely never communicate with each other and "black hats" identities are known by very few. The are each tasked with doing whatever they like in whatever way they like whenever they like and against any site the company owns, their only responsibility is to immediately inform the company when they find issues, ideally with resolution solutions if available.

I know this sounds extreme but it's a policy/tactic used across the world by organisations of a certain size/responsibility and if you can afford it, and if you can find them, I suggest you strongly consider this approach.

2
  • 4
    "and if you can afford it, and if you can find them, I suggest you strongly consider this approach." I thought you were about to suggest hiring the A team then... Jun 22, 2011 at 10:23
  • 3
    I was wondering if anyone would spot that ;)
    – Chopper3
    Jun 22, 2011 at 10:27
4

I think you'd be amazed at how bad some "security" specialists are. Count yourself lucky you haven't been led astray by gems like

"your network ports aren't open so we can't scan you, so need you to open up the servers so we can scan"

or

security wizards:"you can't use sslv2 its insecure" IT:"but the only options are SSL and cleartext" Security:"at least cleartext doesn't have vulnerabilities"

If you have 2different firms auditing you and both think you are fine, I wouldn't hire yet a third. The only thing I'd change is consider if your OS vendors have a security audit service.

And my personal favorite

Security:"we can only scan the UNIX boxes, none of the windows boxes you told us about will respond on any port" IT: yes we use domain isolation to deny access to non domain joined systems Security:that's not in the NIST guidelines, you'll have to disable that, its not secure"

3

As someone who has managed many hundreds of penetration tests for organisations in the Fortune and FTSE 100 as well as very small local companies I have the following for you:

Broadly speaking you are doing the right thing with regards pen testing in terms of using well known external companies to see what they can get access to, however the most appropriate way to do this is:

  • Understand your threats
  • Understand your risk profile
  • Define your controls needs - based on your paranoid clients etc.
  • Build technical controls to meet those needs
  • Use penetration testing to confirm correct implementation of controls

You should plan to use a variety of companies or rotate them. I tend to encourage people to use a panel of 4 or more, as each has their spacialisations and specific experience.

You will never be secure, but you can get 'secure enough' based on the risk profile your company wishes to accept. Don't assume that because you are small that you are not a target - current organised crime structures sell on exploit methodologies from successful large organisation hacks downwards, and if you are on the Internet you are a target whether you like it or not.

Various questions over on security.stackexchange.com have covered this question so it is worth having a look over there.

1

Personally, I would turn up usage software like Nessus that you mentioned and maybe Tripwire and necessary auditing systems, and have someone regularly review the logs or have a program parse and alert for you based on said logs. I think more than likely you're going to run into the need to meet compliance standards which doesn't necessarily mean good security. I'd keep my focus on being able to detect and audit access to your systems. However I would point you did not mention what you are doing for intrusion prevention or detection systems?

2
  • and to answer your question more directly, you probably would need to go to security firm or an independent contractor for this. I have no idea about the costs, but the project would be all about testing what you already have, and then improving it. Jun 21, 2011 at 5:02
  • This is one of the most durable solutions yet proposed: Nessus, Splunk, and some general "wierd behavior" monitor like Zenoss when properly configured are your best friends. However, a lot of people assume they are "drop in" solutions, which they aren't. There's a very high setup overhead, and, once done, a very high security yield.
    – Zac B
    Oct 15, 2012 at 19:49
1

Ummm... It's already been said that you've probably done all that's necessary. Again, how paranoid do you need -- repeat, NEED -- to be?

At the risk of being too basic, most penetration is achieved only after an appropriate password has been uncovered. It is a matter of cold hard fact that:

a) many passwords are too simple, used only because the boss says they must. The classic example is the IT troubleshooter using the password "test".

b) most (but not all) penetration now by-passes the tried and true bribery/blackmail and uses electronic methods of password acquisition -- but you cannot be penetrated until the password is there.

I assume your hardware is penetration-proof? One make of computer that I know of, probably others as well, has a conveniently placed dip-switch rack which can be used to disable the login password AND the BIOS password...

Personally, I would assume I will be penetrated sooner or later, so I make sure I can detect any intrusion, and continue post-penetration. Have you backed up?

6
  • 1
    Good point re:backups. Assume compromise is inevitable and work from there. Jun 21, 2011 at 7:09
  • I think he want to test some attacks like deny attack, forcefull attack, domain name attack and so on. Jun 21, 2011 at 8:39
  • Actually, most penetrations are not through passwords. Check out Verizon's 2011 Data Breach Investigation Report
    – Rory Alsop
    Jun 22, 2011 at 8:56
  • Aaahhh... @Rory - Thank you. I did. Very interesting. (verizonbusiness.com/resources/reports/…). I'll quote: "Absent, weak, and stolen credentials are careening out of control." "...the continued rise of the Zeus Trojan and other malware variants created to capture login credentials..." "...we find that “exploitation of default or guessable credentials” is represented in two-thirds of all intrusions and accounts for nearly one-third of all records compromised." A password is not always a string of characters. Jun 24, 2011 at 15:31
  • Interesting @Gordon - I think we are coming at the data in the DBIR two different ways. Gaining access through zeus or other malware doesn't really depend on the password (however long it is, it will be grabbed by the trojan) so although the creds are a part of it, the attack here is on vectors such as XSS, and the majority of records stolen are through malware which implements backdoors.
    – Rory Alsop
    Jun 24, 2011 at 17:44
1

Do you need to hire a hacker? I don't believe so. Besides, how would you determine which hacker is worth hiring? Let's face it, this isn't the kind of honourable person who's word you can rely on, so just because they tell you how great they are doesn't mean they're actually any good.

Let's start with a basic premise: There is no such thing as a public facing system that cannot be penetrated. However, there are a great many systems that will stand up to all but the most hard-core and dedicated attacker.

It's not really about absolute security, it's more about the risks and your ability to detect and recover from an attack. Backups are obviously an absolute must. So are periodic test restores to verify those backups.

An IDS should alert you to hacking attempts, although you need to be mindful that any Internet facing system can expect to be attacked, which results in there being so many alerts that you need be able to ignore the vast majority and concentrate on those that are out of the ordinary, as those are what will most likely point to someone better than the typical half-brained script kiddy.

A tripwire type system, which can take whatever form you choose, goes a long way towards detecting an attack, at which point the system should be taken down and analysed to determine how the attack occurred, prior to the system being restored from a known good backup, with no attempt made to just repair the compromised system, as that is a lesson in futility.

2
  • hacker != bad guy. For my security teams I have tended to hire or approve people with a hacker mentality as they are problem solvers.
    – Rory Alsop
    Jun 22, 2011 at 8:57
  • @Rory, hacker doesn't always equal bad guy but the reality is that those worth using for penetration testing most often are. Jun 22, 2011 at 21:48
1

All the above answers are really great and with many things there is no real definitive way to answer this Yes or No.

I work with Small Businesses to help secure their environments and in general doing a "Vulnerability Assessment" or straight up Penetration Test is usually going to not provide a whole lot of information that you couldn't or probably have already gotten yourself. Scanners are a great STARTING point. But if everything is simply just based on the scan results than I would say you are definitely not getting your money's worth.

If you are hiring an outside company to do your pentest/audit/assessment or whatever you want to call it, you should be hiring people that can do more than just $scanner. They are not fool proof and from my experience there are a lot of false positives that takes a human to correctly interpret.

In my opinion, the black box style pentest that a lot of businesses want to use will not expose a lot of information that you do want. For example, let's just say an attacker DOES, throughout whatever means, gets inside of your network. Can they bypass controls to pivot elsewhere? What if an attacker gains access to a customer service computer or a contractor's computer. Can they pivot to other areas of the company? If so what can they see? Can they get to backups? Production data? Accounting information?

And if Social Engineering is not a part of the engagement, than you are leaving a huge hole in the companies threat surface.

Working for a small IT company, budgets for an external audit can be difficult to come by, especially if there is no industry compliance at play mandating a yearly audit.

Think about the following things

  • How do we detect malicious activity in our company?
  • Would we know if someone is running tools against our servers? Websites?
  • Are employees keeping plain text passwords on their computers? (probably a lot more prevalent than you might think).
  • Can we audit what employees are doing on our network?
  • If we had to completely wipe a server, how fast can we replace it?

These are just a few things off the top of my head, but looking frankly at these items and if you can't answer these than spend the time figuring out what to do about them. It will be better spent.

You should approach this from the standpoint that an attacker WILL be able to get inside your network. What do you do then? How do you mitigate that threat and reduce the impact? How will you even know?

0

Some considerations:

First, what is the goal you are trying to achieve? The various security services like penetration tests, vulnerability assessments, and "ethical hackers" are not simply "buying more security." You have to have a goal in mind; the basic goal of this kind of expenditure is to discover vulnerabilities in software, networks, processes, and procedures. This is important: in order for an audit, assessment, or test to improve your security, you will need to do something about the findings. This almost always means spending more money, whether on software, personnel, or insurance. You should have someone on your staff whose responsibility is security; they should have the technical chops to call bullshit on security vendors as needed, and the integrity to track vulnerabilities and advocate for security improvements in all areas of your business.

Second, and closely related, don't pay for information you already have. If you know you have a particular security problem, don't pay an "ethical hacker" to rediscover it. Spend that money to fix the problem. If the test is mandated anyway, be honest about your known vulnerabilities up-front. A good tester will be able to tailor their assessment towards areas of unknowns in order to maximize your investment. Consider rotating between assessment types to maximize coverage. Do a black-box external penetration test, then an internal test simulating a disgruntled employee, then a targeted white/gray box test of your most critical systems, etc.

Third, invest most of your time and effort in the test before it occurs. Research the security service provider, including checking references, not just certifications. There are lots of frauds and shoddy workers out there. Ask to see examples of their reports. If it's not actionable information, why pay for it? Ask to see their testing methodology. If they balk, bail. If they don't have a repeatable process, you can't be assured of a thorough test. A vulnerability scan with Nessus or Retina is not a penetration test; don't pay premium prices for cheap services. Get heavily involved in the negotiation of test scope. The more you free the hands of the testing team, the better and more realistic results you'll get.

Fourth, for penetration tests, make sure you're paying for a test that emulates a realistic threat. Dan Guido of Trail of Bits has done some excellent research on intelligence-driven defense--knowing the threats your organization faces and optimizing your defenses to them, rather than just blindly spending money on what everyone else is doing. Check out their papers on the Exploit Intelligence Project and Attacker Math. It's simple enough that you can perform a preliminary analysis yourself, then use it to fact-check the claims of teams that are trying to sell you their services. Trail of Bits even offers consulting in this and other areas. (I am not affiliated with Trail of Bits in any way)

Finally, don't buy into the hype over the word "hacker," especially with the "ethical" part attached. There are certifications that indicate some basic level of skill, but opinions in the industry vary widely; let "ethical" be demonstrated by a person's behavior and references, not a certification. A person does NOT need to be "reformed" to have skill; don't exempt someone in this field from any background checks, criminal or otherwise, that you would hold your regular employees to. Security testing isn't "magic," and poor work habits are not an "eccentricity" that goes with the territory. You have the right to expect the highest ethical responsibility and integrity of your security testers as any other position, if not more.

Not the answer you're looking for? Browse other questions tagged .