Is it worth hiring a hacker to perform some penetration testing on my servers?

Question

I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us ; In the past, we've already mandated two penetration testing from independent companies specialized in this area (Dionach and GSS). We've also ran some automated penetration tests using Nessus.

Those two auditors were given a lot of insider information, and found almost nothing* ...

While it feels comfortable to think our system is perfectly sure (and it was surely comfortable to show those reports to our clients when they performed their due diligence work), I've got a hard time believing that we've achieved a perfectly sure system, especially considering that we have no security specialist in our company (Security has always been a concern, and we're completely paranoid, which helps, but that's far as it goes!)

If hackers can hack into companies that probably employ at least a few people whose sole task is to ensure their data stays private, surely they could hack into our small business, right ?

Does someone have any experience in hiring an "ethical hacker"? How to find one? How much would it cost?

---

*The only recommendation they made us was to upgrade our remote desktop protocols on two windows servers, which they were able to access because we gave them the correct non-standard port and whitelisted their IP

Answer 1

Its good that you are thinking about being secure, but there is no such thing as a "sure system". Modern security practice involves isolating servers so breaches are contained rather than prevented. All webservers and other remotely accessible servers should be placed in an isolated DMZ that has only a limited subset of data (i.e. - as little as possible to perform the task at hand).

The best security advice is to act and plan as if servers with remotely accessible services are already compromised. For internal data, secure your most important assets so only the people who have a job role that requires them to access them can access them and there is no way for them to access the data off-site or to download it all onto a USB key.

Security is a cost-benefit equation, it is very costly to setup secure systems and you should only add additional security measures when they are required. Setting up retina scanners, man-traps, keypads and so forth to get into your office would be a waste of money unless there is something inside that you really need to be paranoid about. Spending money on security to try and reduce your "feeling" of paranoia, is not good spending. Spend it on the risk that you will be hacked and the impact if you are.

Do the best-effort stuff with your services: as few ports open as possible with as few services. Keep them up-to-date. Follow security mailing lists and bug-reports about the software you are running. Read "hardening" guides for webservers.

It is generally more cost-effective to focus on isolation and detection that prevention. IDS products or log analysers can be really useful here.

Answer 2

The majority of my work is for a company that NEEDS very high levels of security and has the wherewithal to achieve that. As such they have "white hats" and "black hats", the former are employees who design, implement and test within limits the security systems. The latter are external guys who are reformed crackers, some with criminal records, almost all are significantly involved in open-source code projects with a security angle. The two teams absolutely never communicate with each other and "black hats" identities are known by very few. The are each tasked with doing whatever they like in whatever way they like whenever they like and against any site the company owns, their only responsibility is to immediately inform the company when they find issues, ideally with resolution solutions if available.

I know this sounds extreme but it's a policy/tactic used across the world by organisations of a certain size/responsibility and if you can afford it, and if you can find them, I suggest you strongly consider this approach.

Answer 3

As someone who has managed many hundreds of penetration tests for organisations in the Fortune and FTSE 100 as well as very small local companies I have the following for you:

Broadly speaking you are doing the right thing with regards pen testing in terms of using well known external companies to see what they can get access to, however the most appropriate way to do this is:

• Understand your threats
• Understand your risk profile
• Define your controls needs - based on your paranoid clients etc.
• Build technical controls to meet those needs
• Use penetration testing to confirm correct implementation of controls

You should plan to use a variety of companies or rotate them. I tend to encourage people to use a panel of 4 or more, as each has their spacialisations and specific experience.

You will never be secure, but you can get 'secure enough' based on the risk profile your company wishes to accept. Don't assume that because you are small that you are not a target - current organised crime structures sell on exploit methodologies from successful large organisation hacks downwards, and if you are on the Internet you are a target whether you like it or not.

Various questions over on security.stackexchange.com have covered this question so it is worth having a look over there.

Answer 4

Personally, I would turn up usage software like Nessus that you mentioned and maybe Tripwire and necessary auditing systems, and have someone regularly review the logs or have a program parse and alert for you based on said logs. I think more than likely you're going to run into the need to meet compliance standards which doesn't necessarily mean good security. I'd keep my focus on being able to detect and audit access to your systems. However I would point you did not mention what you are doing for intrusion prevention or detection systems?

Answer 5

Ummm... It's already been said that you've probably done all that's necessary. Again, how paranoid do you need -- repeat, NEED -- to be?

At the risk of being too basic, most penetration is achieved only after an appropriate password has been uncovered. It is a matter of cold hard fact that:

a) many passwords are too simple, used only because the boss says they must. The classic example is the IT troubleshooter using the password "test".

b) most (but not all) penetration now by-passes the tried and true bribery/blackmail and uses electronic methods of password acquisition -- but you cannot be penetrated until the password is there.

I assume your hardware is penetration-proof? One make of computer that I know of, probably others as well, has a conveniently placed dip-switch rack which can be used to disable the login password AND the BIOS password...

Personally, I would assume I will be penetrated sooner or later, so I make sure I can detect any intrusion, and continue post-penetration. Have you backed up?

Answer 6

Do you need to hire a hacker? I don't believe so. Besides, how would you determine which hacker is worth hiring? Let's face it, this isn't the kind of honourable person who's word you can rely on, so just because they tell you how great they are doesn't mean they're actually any good.

Let's start with a basic premise: There is no such thing as a public facing system that cannot be penetrated. However, there are a great many systems that will stand up to all but the most hard-core and dedicated attacker.

It's not really about absolute security, it's more about the risks and your ability to detect and recover from an attack. Backups are obviously an absolute must. So are periodic test restores to verify those backups.

An IDS should alert you to hacking attempts, although you need to be mindful that any Internet facing system can expect to be attacked, which results in there being so many alerts that you need be able to ignore the vast majority and concentrate on those that are out of the ordinary, as those are what will most likely point to someone better than the typical half-brained script kiddy.

A tripwire type system, which can take whatever form you choose, goes a long way towards detecting an attack, at which point the system should be taken down and analysed to determine how the attack occurred, prior to the system being restored from a known good backup, with no attempt made to just repair the compromised system, as that is a lesson in futility.

Answer 7

I think you'd be amazed at how bad some "security" specialists are. Count yourself lucky you haven't been led astray by gems like

"your network ports aren't open so we can't scan you, so need you to open up the servers so we can scan"

or

security wizards:"you can't use sslv2 its insecure" IT:"but the only options are SSL and cleartext" Security:"at least cleartext doesn't have vulnerabilities"

If you have 2different firms auditing you and both think you are fine, I wouldn't hire yet a third. The only thing I'd change is consider if your OS vendors have a security audit service.

And my personal favorite

Security:"we can only scan the UNIX boxes, none of the windows boxes you told us about will respond on any port" IT: yes we use domain isolation to deny access to non domain joined systems Security:that's not in the NIST guidelines, you'll have to disable that, its not secure"