All language subtitles for 007 Assessment Types (OBJ 1.3)

Instructor: There are many different types

of penetration tests and assessments,

including goals-based, objectives-based, compliance-based,

pre-merger, supply chain, and red team assessments.

A goals-based assessment

is designed with a specific goal in mind.

In this case, the penetration tester

may attempt to find as many unique ways as possible

to achieve that specific goal,

such as breaking into a facility

to test its physical security.

Now, for example, let's say a tester

might want to come in through the front door.

They might use social engineering

and piggyback or tailgate in.

They might jump over a fence

or even pick a lock on the door.

For a goals-based assessment,

it really doesn't matter how they go about doing it

as long as they're successful

in trying to achieve that specific goal.

In this example, gaining physical access to that facility.

Next, we have objective-based assessments.

Now, objective-based assessments

are those where a tester seeks to ensure

that the information remains secure.

If this information is on a file server inside the facility,

then there are many different ways to get that information.

You could break in using physical methods

to steal the hard drive.

You could hack into the server using a server-side exploit.

Or you could even use a phishing attack

to gain access to a system

by having the user click on a malicious link.

Again, it really doesn't matter how we go about it

as long as we make sure

that the objective of the assessment is clear,

ensuring that the information is safe from attack

from as many sides as possible.

For this reason, this type of testing

is more similar to a real attack,

because the penetration tester can be creative

and try various methods for stealing that information.

And really, they only have to be successful

one time or one way

to consider that they have met their objective.

The third type of assessment

is known as a compliance-based assessment,

and this focuses on finding out if policies and regulations

are being properly followed.

This is one of the most common types of penetration tests

that are conducted in our industry.

For example, if an organization takes credit cards,

they have to follow the rules for PCIDSS.

All the major credit card processors

like Visa, MasterCard, and American Express

have all agreed to set up regulations and policies

that require a regular scanning of a checklist of items

if that organization is going to be allowed

to process or store customer credit cards.

In this type of penetration test,

the objectives are clearly defined

and the penetration tester can utilize a checklist

to verify that everything is properly scanned

and found to be secure.

This checklist may include things like password policies,

data isolation policies, limiting network storage access,

key management, and so on.

The objectives are always clearly stated

in this type of a test.

Other examples of compliance-based assessments

include GDPR, HIPAA,

Sarbanes-Oxley, and GLBA compliance audits.

A pre-merger assessment is our fourth type of assessment.

A pre-merger assessment is gonna be conducted

between two companies

before they merge with each other

during a period of time known as due diligence.

During this timeframe, each company is gonna look

at the other company's financial records, personnel records,

and often they'll require

a third party penetration testing firm

to assess the other company's network,

with their permission, of course,

in order to determine if a merger

and the interconnection of those two networks

could weaken the overall cybersecurity posture

of either company.

Another type of penetration test

is known as a supply chain assessment.

Now, a supply chain assessment occurs

when a company requires its suppliers

to ensure that they've met a given level

of cybersecurity requirements

before you'll do business with them.

As a professional penetration tester,

it's always gonna be important to be careful

with this type of assessment

and gain permission from both the organizations

that are asking for the assessment

and the one you're assessing

prior to conducting that assessment.

As a third party organization,

that penetration testing company

cannot simply start hacking an organization's supplier

to see if they're secure.

Instead, you must get permission

from the owner of the network,

which in this case would be the supplier,

even though the person who's paying you, your client,

might be the other organization.

If permission is granted, however,

and it's within the bounds of the contract

and the statement of work,

then the penetration tester

should attempt to break into the supply chain

because oftentimes the supply chain is the weakest link

in a large enterprise or organization.

For example, a major retailer, Target, in the United States

actually suffered a major security breach

of their network several years ago.

Instead of the criminal threat actors

going after Target's networks directly though,

they exploited a vulnerability

at one of Target's smaller suppliers,

which was an air condition supply company,

and their network security was much weaker

but it was still interconnected

into the more secure network owned by Target.

Now, criminals are always gonna seek the path

of least resistance,

and therefore it's important to ensure

a high cybersecurity posture

for any organizational network you have

and verify the trustworthiness and security

of any of the supplier networks

that are gonna interconnect

into your organizational network.

The final type of engagement we have

is called a red team assessment,

which is the execution of a penetration test

against the organizational network

by its own internal penetration testers.

These penetration testers are also known as the red team,

and they're gonna be authorized

to conduct security exercises

that are on a production network,

a virtualized environment, or both.

The red team are often considered the offensive side

of the cybersecurity industry,

while our blue team is considered the defensive side.

If the red team is tasked with conducting the assessment

in a virtualized environment,

then the organization is also gonna require

their network defenders and cybersecurity analysts

to connect into that environment

and participate as the defenders

for the engagement as the blue team.

Often, there'll also be a white team

to oversee this engagement,

and they act as the referee

and ensure the red team is playing fairly

as well as determining if the blue team

is able to observe and stop the attacks

that the red team is throwing.

These engagements will serve as a form of war gaming

that allows both the attackers and defenders

to increase their own skill

by conducting and observing real world attacks

in an isolated virtual environment.

Now, once the type of assessment is chosen,

the team will meet

with the client organization's stakeholders

to determine which strategy

they're gonna use during the engagement.

Now, there are three common strategies that we can use.

There is unknown environment testing,

partially known environment testing,

and known environment testing.

An unknown environment test

refers to the assessment where the penetration tester

has no prior knowledge of the target organization

or their network.

This simulates an outside attack

from the perspective of an external hacker

and focuses solely on what an external attacker could see

while completely ignoring an insider threat.

This type of assessment does require more time

and is therefore usually gonna be much more expensive

than a partially known environment

or a known environment assessment.

In an unknown environment test,

the penetration tester is gonna need to spend a lot of time

doing information gathering and vulnerability scanning

in order to learn all about the network

and how to best exploit its weaknesses.

The biggest benefit of an unknown environment test

is that the penetration tester

conducts the entire engagement

as if they were an actual threat actor

by scanning for available network resources,

identifying live hosts, scanning for open ports,

and fingerprinting running services

before they actually exploit any of the assets,

just like a real unauthorized attacker would.

Now, a partially known environment test

is the most common type of assessment,

and it entails partial knowledge of the target organization

and their information systems.

For example the organization

may provide the penetration tester with their IP range

to ensure they're only probing their networks

and not some other organization's network by mistake.

This type of test may also be used

to simulate an insider threat

who has minimal knowledge of the organization,

like a regular employee would.

For instance, the penetration tester

may be asked to go on site,

they'll be given a username and password,

and they'll be able to conduct their assessment

from the perspective

of an authenticated standard employee user account.

The assessor can then see what kind of data could be taken,

what servers are subject to privilege escalation,

and other types of issues that are common

to insider threats.

A partially known environment test

allows the penetration tester

to decrease the amount of time spent

in the information gathering phase,

and therefore it allows them to spend more time

identifying potential vulnerabilities and exploiting them.

A potentially known environment test

is also commonly used to test web applications and APIs

for different security vulnerabilities

by giving the penetration tester

some information about the application or API,

such as its internal functionality

and the basic inputs and outputs,

but not the entire source code.

Now, the third type we have

is called a known environment test,

and a known environment test is an assessment

in which the penetration tester

is given all the details about the organization,

the network, the systems, and the underlying architecture.

As part of the contract,

the assessor might be given network diagrams, IP addresses,

versions of operating systems, and services that they use.

We would also receive a full copy of the source code

and associated documentation

if we're gonna be doing a web application or API assessment.

When conducting a known environment test,

the penetration tester is able to spend more time

probing for vulnerabilities and exploits

without having to spend as much time

in the information gathering phase,

because all the details

have already been provided in a truly transparent manner.

(upbeat music)