IT Security Audit: Important Terms
“Hacker stole thousands of credit card numbers” is a story that seems to run in the news on a daily basis.
In order for businesses to adequately protect their internal and customer data, they must understand the risks and vulnerabilities affecting their systems. Penetration testing and vulnerability assessment are two paths to understanding these risks. Although these terms tend to be used interchangeably, they are in fact different procedures. Understanding the differences between these two types of assessments is important when selecting the one that best fits the needs of the business.
Penetration testing provides a view of the risks and vulnerabilities that exist within a business’ internet-facing systems. Often called “ethical hacking,” penetration testing requires security professionals to mimic the tactics and tools used by those with malicious intent. These professionals are looking to identify the system vulnerabilities where outsiders could gain access to sensitive data or systems. The ultimate goal of the penetration test is to find a way into the network and systems.
External penetration testing also provides organizations the opportunity to test their incident response process and procedures. Coordinating activities with just IT management, and not the entire IT group, allows management to observe the actions of IT staff during a security incident and determine whether procedures are adequately followed.
Vulnerability assessments, on the other hand, take a top-to-bottom approach to identifying weaknesses affecting both internal and external networks. These assessments are an interactive method of data security testing with the subject participating throughout the analysis. The entire organization is fully aware of the approach being followed and the security measures that are in place.
Considerations
Where do you begin once you have identified the need for a data security review? It is important to consider several factors when choosing a security test approach. These include:
- Who is the target audience?
- Have there been recent incidents impacting data security?
- How mature is the organization’s security function?
- What is the desired time frame for performing the analysis? How often should this analysis occur?
- What is your budget for the data security review?
“Vulnerability assessments often take longer, so the time frame is important with this choice” and Pricing is also an issue for many companies. The number of hosts, complexity of the technology environment, existing level of security and amount of information provided up-front are some of the factors that have a bearing on costs. For example, if the organization periodically performs their own reviews, it makes the process easier and reduces costs. A centralized IT environment is also optimal.”
Once the need for the security review is established the next step is a detailed analysis of the company network. This includes:
- Gathering public information by searching registered domains and networks, corporate filings, and the internet.
- Identifying target networks and confirming the assessment targets.
- Identifying open ports and services.
- Determining the impacted operating systems and assessing their function.
Considering using one of the available automated tools to identify vulnerabilities and collect data, including valid system accounts, network resources and applications.
We can see if there’s a web server, file server, email server or other systems that support their external presence on the internet. There are tools to see what’s secure and not secure, but we also perform manual steps to look for other vulnerabilities.
Web application programming issues are high-risk vulnerabilities that are very common right now. A lot of web development has been done in-house by programmers that they not explored much about security programming. People can gain significant access to the environment using exploits against web applications. The number of occurrences of this nature is going up and up. Of course, we still identify plenty of basic security issues such as weak passwords.
Using the information obtained in the network analysis, it is important to identify which areas to include in the penetration test or vulnerability assessment. In doing this, consider the following:
- Determine what is inside versus outside of the perimeter of the company network. This might include:
- Third-party connections
- Remote access (VPN, Modems, etc.)
- Wireless access
- Physical access.
- Decide how much information you want to make available during the security review via:
- Router configurations
- Firewall rule bases
- Wireless access point configurations
- Password files
- Account access to applications.
Risk Assessment
Penetration tests and vulnerability assessments can potentially disrupt operations to varying degrees. Companies should balance the need to adequately test the target systems with the need to keep them up and running. The risks associated with security tests can include:
- Temporarily breaking a system or denying legitimate service.
- Creating a backdoor or insecure condition that is not removed in a timely manner.
- Creating confusion in the organization if the activity is detected but not recognized as part of a test.
- A real attack occurring at the same time as the test, leading people to ignore the attack in the belief that it is part of the test.
The risk of impacting systems unnecessarily is greater with penetration testing and often we will identify vulnerability without exploiting it in order to avoid having a negative impact.
With assessing risk also comes the need for open communication during each stage of the security review. Clear communication is also imperative in identifying business process issues, performing root-cause analysis, and finalizing reports. During the reporting process, attention to the following can facilitate the communication flow:
- Base the level of report detail on the needs of the audience.
- Aggregate the data appropriately rather than using it multiple times throughout the report.
- Consider presenting the details by using databases, spreadsheets, and charts.
- Identify trends and root causes and articulate their impact to the project.
- Present findings and action items in order of importance.
Close communication is important for fieldwork and deliverables in the reports. Always discuss initial findings before they appear in a report, to make sure things are understood correctly. Good communication also ensures delivery of the project in a way that meets expectations.
– Thank you to Michael Richardson
