Penetration testing: Pros and cons of attacking your own network

Penetration testing (or pen-testing) is a term common to most information security professionals, and is defined by (ISC)2 as, “A method of evaluating internal and external technical security controls through a methodically planned simulated attack that imitates threats from malicious outsiders and malicious insiders to understand the security weaknesses in a system and/or network.”

More tangibly, it represents the coordinated, controlled, professional exploitation of network, system and process vulnerabilities within any enterprise IT environment. Also used synonymously to describe the practice of mimicking attackers is the term red-teaming, which often indicates a group of pen-testers working together.

Pen-testing activities can be leveraged by a government agency as a means of exposing shortcomings in its existing efforts to ensure the confidentiality, integrity and availability of the environment and its data. When properly executed, pen-testing can be a critical tool in assessing and improving the cybersecurity posture of the organization. When NOT properly executed, testers can crash servers, expose sensitive data, corrupt crucial production data or cause a host of other adverse effects associated with mimicking the actions of attackers with malicious intent.

Automating the process adds significant value to any information security strategy. However, automation can also act as a sort of siren song, often lulling security personnel into a false sense of security. As the overall level of automation within an environment increases, it becomes more difficult to see the forest through the trees, paying negative dividends in the form of complacency and unmanageable complexity.

Automated security measures such as “patch-and-pray” activities are clearly necessary but can also be viewed as an approach that suffers from marked un-scalability. As inadequate as they are necessary, our automated tools can never quite take the place of a finely tuned human mind. False positives (and more frighteningly, false negatives) are commonplace.

The goal of pen-testing is twofold: it can find the things our automated tools may have missed and it can validate our assumptions and understandings of our environments.

The pen-testing debate

While pen-testing can become an indispensable tool in the never-ending battle between the good guys and the ne’er-do-wells that lurk within the dark recesses of the Internet, the use of pen-testing in an organization represents a multifaceted debate. Why? The act of pen-testing is often questioned regarding the relative value of the activity, the amount of trust we can (or cannot) place in the testers themselves (after all, they're being paid to break into an organization’s network and devices), and the theory that pen-testing essentially legitimizes bad behavior that used to be the exclusive domain of the criminal element.

So, is pen-testing appropriate for every organization?

Some would say that any organization that has available funds within its information security budget will want to leverage this activity, but more complex considerations arise when attempting to define when, how, and exactly what scope will define these engagements.

The pen-testing investment: For pen-testing to be done well, the tester’s skill set requires creativity, tenacious drive, and a knack for identifying unexplored perspectives. When pen-testing goes wrong, bottom lines are impacted in the form of lost productivity, data leaks or even loss of life (as can be the case when life safety equipment is involved). This work is labor-intensive and does not come cheap.

Considering that federal employees are bound by a fiduciary duty to wisely and effectively spend the taxpayers’ hard-earned dollars, the financial risks represented by deploying regular pen-testing can seem significant. The question then becomes, can the potential risks be minimized enough for pen-testing to be considered worth the investment?

The pen-testing professional: By hiring certified pen-testers, an organization demonstrates its commitment to doing business with those who view themselves as professionals and who make every effort to conduct themselves in a professional manner.  Awarding this work to “professional hobbyists,” while certainly possible (and undoubtedly cheaper), sends a very different message.  Certifications applicable to a professional pen-tester typically include mandatory adherence to a certain code of ethics (such as the (ISC)2 Code of Ethics).  Professional certifications also provide a sort of basic minimum assumption of skills and behaviors, such as the dangers of sloppy network mapping techniques or the use of industry best practices and guidance. Granted, credentials on a business card do not guarantee a person’s level of skill or professionalism, but the alternative would hardly be viewed as sufficient due diligence on the part of an organization seeking to implement a sound practice of pen-testing.

In the end, pen-testing can be an indispensable tool and its value should not be minimized. It can also be very dangerous when not executed with proper diligence. The key is to do it well and to minimize the risk. Judicious scoping, close attention to budget concerns, and the use of certified pen-testers increase assurance that penetration testing will improve the security posture of the operational environment.