Penetration Testing

A penetration tester is a white hat hacker who receives authorization to attempt to break into an organization's physical or electronic perimeter (sometimes both). Penetration tests (called “pen tests” for short) are designed to determine whether black hat hackers could do the same. They are a narrow but often useful test, especially if the penetration tester is successful.

Penetration tests may include the following tests:

• Network (Internet)

• Network (internal or DMZ)

• War dialing

• Wireless

• Physical (attempt to gain entrance into a facility or room)

Network attacks may leverage client-side attacks, server-side attacks, or Web application attacks. War dialing, which gets its name from the 1983 movie WarGames, uses a modem to dial a series of phone numbers, looking for an answering modem carrier tone. The penetration tester then attempts to access the answering system.

Social engineering is a no-tech or low-tech method that uses the human mind to bypass security controls. Social engineering may be used in combination with many types of attacks, especially client-side attacks or physical tests. An example of a social engineering attack combined with a client-side attack is emailing malware with a subject line of “Category 5 Hurricane is about to hit Florida!”

A zero-knowledge test, also called black-box test, is “blind”; the penetration tester begins with no external or trusted information and begins the attack with public information only. A full-knowledge test (also called crystal-box test) provides internal information to the penetration tester, including network diagrams, policies and procedures, and sometimes reports from previous penetration testers. Partial-knowledge tests are in between zero and full knowledge; the penetration tester receives some limited trusted information.

Vulnerability Testing

Vulnerability scanning or vulnerability-testing scans a network or system for a list of predefined vulnerabilities such as system misconfiguration, outdated software, or a lack of patching. A vulnerability-testing tool such as Nessus (http://www.tenable.com/products/nessus-vulnerability-scanner) or OpenVAS (http://www.openvas.org) may be used to identify the vulnerabilities.

Security Audits

A security audit is a test against a published standard. Organizations may be audited for Payment Card Industry Data Security Standard (PCI DSS) compliance (discussed in Chapter 3), for example. PCI DSS includes many required controls, such as firewalls, specific access control models, and wireless encryption. An auditor then verifies that a site or organization meets the published standard.

Security Assessments

Security assessments are a holistic approach to assessing the effectiveness of access control. Instead of looking narrowly at penetration tests or vulnerability assessments, security assessments have a broader scope.

Security assessments view many controls across multiple domains and may include the following:

• Policies, procedures, and other administrative controls

• Assessing the real world-effectiveness of administrative controls

• Change management

• Architectural review

• Penetration tests

• Vulnerability assessments

• Security audits

As the above list shows, a security assessment may include other distinct tests, such as a penetration test. The goal is to broadly cover many other specific tests to ensure that all aspects of access control are considered.

Log Reviews

Reviewing security audit logs within an IT system is one of the easiest ways to verify that access control mechanisms are performing adequately. Reviewing audit logs is primarily a detective control.

The intelligence gained from proactive audit log management and monitoring can be very beneficial; the collected antivirus logs of thousands of systems can give a very accurate picture of the current state of malware. Antivirus alerts combined with a spike in failed authentication alerts from authentication servers or a spike in outbound firewall denials may indicate that a password-guessing worm is attempting to spread across a network.

Static and Dynamic Testing

Static testing tests the code passively; the code is not running. This includes walkthroughs, syntax checking, and code reviews. Static analysis tools review the raw source code itself looking for evidence of known insecure practices, functions, libraries, or other characteristics used in the source code. The Unix lint program performs static testing for C programs.

Dynamic testing tests the code while executing it. With dynamic testing, security checks are performed while actually running or executing the code or application under review.

Both approaches are appropriate and complement each other. Static analysis tools might uncover flaws in code that have not even yet been fully implemented in a way that would expose the flaw to dynamic testing. However, dynamic analysis might uncover flaws that exist in the particular implementation and interaction of code that static analysis missed.

White-box software testing gives the tester access to program source code, data structures, variables, etc. Black-box testing gives the tester no internal details; the software is treated as a black box that receives inputs.

Traceability Matrix

A traceability matrix, sometimes called a requirements traceability matrix (RTM), can be used to map customers' requirements to the software testing plan; it traces the requirements and ensures that they are being met. It does this by mapping customer usage to test cases. Fig. 6.1 shows a sample RTM.

Synthetic Transactions

Synthetic transactions, or synthetic monitoring, involve building scripts or tools that simulate activities normally performed in an application. The typical goal of using synthetic transactions/monitoring is to establish expected norms for the performance of these transactions. These synthetic transactions can be automated to run on a periodic basis to ensure the application is still performing as expected. These types of transactions can also be useful for testing application updates prior to deployment to ensure that functionality and performance will not be negatively impacted. This type of testing or monitoring is most commonly associated with custom-developed web applications.

Software Testing Levels

It is usually helpful to approach the challenge of testing software from multiple angles, addressing various testing levels from low to high. The software testing levels designed to accomplish that goal are unit testing, installation testing, integration testing,

Fuzzing

Fuzzing (also called fuzz testing) is a type of black-box testing that submits random, malformed data as inputs into software programs to determine if they will crash. A program that crashes when receiving malformed or unexpected input is likely to suffer from a boundary-checking issue and may be vulnerable to a buffer overflow attack.

Fuzzing is typically automated, repeatedly presenting random input strings as command line switches, environment variables, and program inputs. Any program that crashes or hangs has failed the fuzz test.

Combinatorial Software Testing

Combinatorial software testing is a black-box testing method that seeks to identify and test all unique combinations of software inputs. An example of combinatorial software testing is pairwise testing, also called all-pairs testing.

Misuse Case Testing

Misuse case testing leverages use cases for applications, which spell out how various functionalities will be leveraged within an application. Formal use cases are typically built as a flow diagram written in UML (Unified Modeling Language) and are created to help model expected behavior and functionality.

Misuse case testing models how a security impact could be realized by an adversary abusing the application. This can be seen simply as a different type of use case, but the reason for calling out misuse case testing specifically is to highlight the general lack of attacks against the application.

Test Coverage Analysis

Test or code coverage analysis attempts to identify the degree to which code testing applies to the entire application. The goal is to ensure that there are no significant gaps where a lack of testing could allow for bugs or security issues to be present that otherwise should have been discovered.

Interface Testing

Interface testing is primarily concerned with appropriate functionality being exposed across all the ways users can interact with the application. From a security-oriented vantage point, the goal is to ensure that security is uniformly applied across the various interfaces. This type of testing exercises the various attack vectors an adversary could leverage.