In the mid-15th century BC the Old Testament (Hebrew) Bible describes the wandering of the Israelite people who had purportedly been released from Egyptian bondage by Divine hand. Some 70 years later they stood on the edge of the so-called ‘Promised Land’, waiting to wage war on the peoples within. But before any attack, the patriarchal leader Moses ordered the first ‘penetration test’ I could locate in recorded history. In simple terms, Moses sent in spies to test out the defences of the land. This is what they reported to Moses (Numbers 13:27):

We entered the land into which you sent us, and it is indeed flowing with milk and honey, and this is its fruitage. Nevertheless, the people who dwell in the land are strong, and the fortified cities are very great. We also saw the Anakim there … and the Canaanites are dwelling by the sea and along the Jordan.

This was, by any definition, an aggressive, well-planned penetration test. Their mission was to test the ability to penetrate the defences of the target and the test successfully highlighted a number of positive opportunities and also issues for them to address:

This metaphor demonstrates exactly the elements that make up the purpose and the desired results of an ‘aggressive’ penetration test against an organisation’s technical and personnel infrastructure. To deploy technical measures, to discover high-value targets, to fingerprint the defences and identify vulnerable resources which need to be exploited to gain access to, or perhaps destroy, the high-value elements.

HOW DOES THIS AFFECT MY ORGANISATION?

Every company, organisation or agency has their ‘milk and honey’, something worth stealing, exploiting or destroying, and it is fundamentally the steps taken by Moses that an attacker would employ to attack your business. An attacker would ask the following questions:

The problem is that we all tend to see our business or organisation in the paradigm of what it makes, sells, employs or otherwise. We do not naturally look at it as an attacker would. For example, your organisation may value its customer list and see risk in terms of what a competitor could do with it. However, an attacker may instead see a customer list as an opportunity to use the data to carry out identity theft, use bank details to steal money, sell stored credit card details and many other possibilities. Indeed, the result of a successful hack may have losses that were not as easy to foresee.

A good example of this was the cyber attack against the mobile and broadband operator TalkTalk in October 2015 (Hodge, 2016). Considerable sums are spent by the company every year protecting the mobile and internet networks it operates and ensuring that private call data is safe from attackers. However, the hack against an arguably softer part of the network resulted in the loss of 150,000 customer records; 15,000 of these included bank account details. Interestingly, in this case, there was no suggestion that these details were used to attack individuals, so it may appear that there was no lasting harm done.

Was there a cost to TalkTalk? Its own figures pointed to a loss of 95,000 customers in three months specifically due to the hack, losing the company an estimated £60 million, perhaps more. Was the hack the result of a nation-state attack or the attention of a crime group? No, in 2016 a 17-year-old boy stood trial for the hack, carried out from his bedroom, and was given a 12-month youth rehabilitation order (Burgess, 2016; ITV News, 2016).

The best type of penetration test will not only probe your network but also identify the risks, the ‘milk and honey’ of your organisation and recommend methods to mitigate loss.

WHY CARRY OUT A PENETRATION TEST?

Your organisation, in fact every organisation, is a target. A small car repair garage could be a target for ransomware, perhaps asked to pay just £100s to unlock data encrypted by malware, which may be a significant sum to a small business. A mid-sized software house may have unreleased software worth stealing; a pharmaceutical company’s intellectual property could be worth millions; even a free online forum may contain user data that would be useful or valuable to an attacker. Every organisation has something worth acquiring. Aside from that, an attacker may just access a network and destroy data, simply for the challenge, just because it’s there.

Too often we see penetration tests being carried out purely to tick a proverbial box for the company board. It may be that the only motives for having a penetration test carried out are for attaining a security standard, fulfilling a contract or insurance terms or simply because it’s the right thing to do. Although these are sound reasons, the primary purpose should be to fully test and understand vulnerabilities that may exist within your organisation. When a penetration test is done just to ‘tick a box’, the resulting report is often read (sometimes just the Executive Summary) and filed until next year with often limited action being taken.

An effective penetration test should fully emulate what a prospective attacker would do, results should be considered and where possible, solutions and fixes implemented.

Getting proactive

If an attacker is going to ask questions of your network, those responsible for the business need to ask them first. It is concerning to note that in many organisations the task of protecting the organisation from attack falls squarely in the hands of the IT department. This is the wrong place to start. The board, following consultation with pertinent departments such as IT, legal and compliance, along with key leaders such as the chief information officer (CIO) and chief information security officer (CISO), should first identify the likely business targets and think through the possible risks, from the irritation of adware appearing on computers to the risks that could result in a business-ending event. Those decisions should not just be the domain of IT – part of it, yes – but management should be driving that conversation.

Unless your business has virtually unlimited resources to spend on consultants, the most effective penetration tests are the ones defined by the organisation itself. An external penetration test company will not be able to easily understand the nuances of your business and a board that has thought carefully about the business-affecting risks can more efficiently target a penetration test against the right assets. This does not mean that a penetration test should always be carried out internally, indeed there are arguments against that, but simply that targets are more easily defined by an organisation. Perhaps the best balance is for a business to define and identify its weaknesses and have those tested both internally and by an experienced external resource.

PENETRATION TESTS WON’T ALWAYS STOP YOU BEING HACKED

In 2016, we at CSITech spent three months planning and executing a penetration test attack against a large bank. We were successful, lessons were learned, holes were plugged and defences hardened. A month later the head of international banking received an email from ‘[email protected]’, asking for $2 million to be transferred to an account in the Middle East immediately. So, he paid up. Our penetration test did its job and improvements were made, but we had not accounted for a person who could not identify a badly constructed phishing attack. This highlighted an area for corporate training.

It is vital that appropriate expectations are set for the board when signing the contract on a penetration test. Penetration testing is a crucial exercise, but it is possible that a test will not highlight an area which is later exploited. Penetration testing can never cover all the bases.

Don’t forget the employees

Your organisation undoubtedly has spent significant resources hardening your network. You install firewalls, intrusion detection systems, anti-virus scanners and a host of other technological defences. The problem is that organisations then make the critical ‘mistake’ of filling the organisation with people. People like to help – but in the security world, that is bad. We train them that way, we tell them that the customer is always right (bad), that you should ‘go the extra mile’ (also bad).

Now, this is, of course, a facetious view of the subject. We need reception staff to smile and be helpful, we need customer relations to not be suspicious of every phone call and email. However, as with the example above, the vast number of modern attacks against companies start with some type of what is termed a ‘social engineering’ attack – essentially, manipulating a human rather than a computer to provide them with information that will often make a resulting technical attack easier. Consider some highly simplified examples:

It is easy to see how, if professionally done, these examples could work, providing an attacker with network access without ever attacking or hacking your expensive firewall. Many other examples can be found at www.phishing.org/phishing-examples.

Frequently these attacks are the result of internet-based research, often called open-source intelligence gathering, carried out by an attacker to glean vital information that they can use to improve the likely success of a social engineering approach or a direct technical attack.

Your organisation, or a third party, should be looking at what information the company leaks through social media, forums, websites and the like.

Modern penetration testing should always include the testing and training of your staff to detect these types of attacks.

STAYING CURRENT WITH EMERGING RISKS

Although crimes such as burglary, fraud, destruction of property and suchlike are as old as civilisation, their application to technology is much more complex. Whereas a property can only be broken into via doors and windows, the ability of an attacker to break into a network shifts and changes with every passing day. Unlike a building, the potential entry points of a network are constantly altering. How so?

A network is a sum of many parts, this could include routers, computers and mobile devices but now extends to the Internet of Things, such as cameras, building control systems, even equipment that controls industrial machinery. Each of those parts contains software and hardware that may be found to be vulnerable to some type of attack. Once a vulnerability is discovered by or disclosed to a hardware or software vendor, they will usually (but not always) move to patch that problem. This corrective measure can, however, result in new vulnerabilities being exposed and the problem continues.

This shifting ‘threat landscape’ makes staying up to date with potential risks a complex task. The primary solution is to have robust procedures for patch management. It is likely that your IT team routinely upgrades server and desktop operating systems – indeed, the deployment of these patches is often automated. Automating patch management is controversial: if an update from a software or hardware supplier is flawed or compromised, this could cause other system problems, crashes, compatibility issues with connected devices and so on. Some organisations delay and test updates to ensure that unforeseen problems are minimised; however, conversely, this approach extends the time for an attacker to exploit non-updated code.

However, the same attention is not given to software and firmware patches relating to systems that may slip into a different department’s oversight. For example, we regularly see CCTV systems still configured with their default firmware and passwords, even though many patches have been released. The same is true for building control systems, radio-frequency identification (RFID) entry systems and similar. This is often because oversight for the system sits elsewhere from IT and the owners are not security aware. Fundamentally, the technical responsibility for security of any system connected to the network should lie within the IT or network security team. Of course, sometimes these systems are maintained and supported by third-party organisations who may not have the same motivation to upgrade and patch systems as your own staff. Risks and benefits need to be balanced when outsourcing support.

Another problem is the long-term issue of support of hardware and software. Manufacturers seem to be increasingly keen to cease development and support of products soon after new versions are released. This can leave assets vulnerable to newly developed attacks.

Also worth considering is that a person bringing a device into work and connecting to the network via a cable or Wi-Fi may introduce an ‘invisible’ attack vector. A good example of this is employees plugging-in their own wireless router into the company network so that their iPad or another device can access the internet. Often these have default passwords or are mistakenly left without encryption turned on, providing an open door for an attacker who may scan your premises for open Wi-Fi networks.

Another method for a manager to keep up to date with vulnerabilities that could affect their company is by monitoring specialist search engines such as Shodan.² Shodan enables a manager to search for devices of interest, and receive a list of known vulnerabilities. This is constantly changing, so searches should be done routinely.

In addition to your own research and policies, any penetration test that is carried out on your network should report not just what you know, but what you do not know. You should be thinking outside of the proverbial box, looking for vulnerabilities that exist using both direct attacks but also considering the lateral approaches that could be employed that you may not have considered.

A good penetration test team will learn about the business and, rather than simply run network scanners and produce automated reports, will strive to identify the areas of risk, the likely threat actors and understand methods that could be employed against you. This should include social engineering attacks as mentioned previously.

WHY ALL MANAGERS SHOULD BE INTERESTED IN SECURITY…

In 1989 Ronald Reagan said ‘Information is the oxygen of the modern age. It seeps through the walls topped by barbed wire, it wafts across the electrified borders’.³ Information pervades every part of an organisation and it is that very information that can be valuable to an attacker but also the fuel by which to launch an attack. As information is generated or used by every department it is beholden on each manager of a department to be security aware to an appropriate degree.

For example, human resources hold significant information on employees and the organisation and the manager should be aware of the risks of mistakenly releasing or losing any of that data, providing appropriate training to their team.

Customer relation teams need to be well trained by their manager in understanding what data is appropriate to share with an external caller. Reception managers should understand policies relating to physical access to the building and what information is appropriate or inappropriate to be shared with a visitor.

All managers need to be aware of security risks and educate their teams to recognise everything from general phishing emails through to well-researched and crafted spear-phishing attempts to extract information or request actions to be taken.

IMPACT ON THE ORGANISATION OF NOT PENETRATION TESTING

Penetration testing can be a time-consuming and reasonably costly process to do properly. It is for these reasons that organisations often sideline this task, instead trusting that IT are doing their job correctly, and that the investment in security hardware and software should do the job fine. This thinking is a false economy – and could cost you dearly. As was previously explained, the cyber-attack surface is an ever-changing environment and both testing internally while also enabling an experienced third party to test your environment is a critical task. Let’s consider the risks and likely costs of not penetration testing your organisation.

Indirect risks or costs here include the following:

Direct risks or costs here include the following:

Penetration tests alone will not eliminate all the possibilities of a successful cyber attack, but pre-planning, carrying out penetration tests and even role playing the attacker can help to mitigate the effects and costs.

SUMMARY

We have seen that every business has its ‘milk and honey’ which attackers may want to steal, leverage or destroy. It is vital that the likely targets are clearly identified, protected and then their defences rigorously tested. Although the IT department has the primary technical role of caring for computer-based resources, the role of identifying business-critical targets needs to fall squarely with the board. Hence, multi-departmental collaboration is essential in planning penetration testing, enabling diverse skills and interests to be represented and dealt with appropriately.

An oft-repeated mantra is that ‘security is the responsibility of the individual’. This requires all staff being trained in basic security practices and then having that training tested. Skills such as being able to recognise a social engineering attack or a phishing email can stop attacks or technical exploitation of a network right at the point of entry.

Planning, training and collaborative working are the elements needed for a successful security environment.

REFERENCES

Burgess, M. (2016) TalkTalk hack toll: 100k customers and £60m. Wired, 2 February 2016. Available at: www.wired.co.uk/article/talktalk-hack-customers-lost

Hazardex (2014) Russian hackers now thought to have caused 2008 Turkish oil pipeline explosion. 21 December 2014. Available at: www.hazardexonthenet.net/article/88497/Russian-hackers-now-thought-to-have-caused-2008-Turkish-oil-pipeline-explosion.aspx

Hodge, N. (2016) TalkTalk’s £400,000 data hack fine is a dire warning. Compliance Week, 8 November 2016. Available at: https://www.complianceweek.com/talktalks-400000-data-hack-fine-is-a-dire-warning/2879.article

ITV News (2016) Boy, 17, behind massive TalkTalk data hack sentenced to 12-month rehabilitation order. ITV Report, 13 December 2016. Available at: www.itv.com/news/2016-12-13/boy-17-behind-massive-talktalk-data-hack-sentenced-to-12-month-rehabilitation-order/