Within any organization.
We have networks which include firewalls, servers, routers, switches, clients,
you name it.
If it's in the network, it's there. We also have buildings.
These can include doors, windows, parking lots.
We even include fences and blocked cages.
It can include all kinds of different aspects on the physical world
and attack surface management takes a new place, all of
different structures within the network ie the logical world as well
as the physical world ie the buildings and the manpower.
We take a comprehensive approach to identify and eliminate
and many of these attack vectors is humanly possible.
Sometimes we can't always eliminate them but can we mitigate the opportunity
that Attackers can utilize that vector in order to attack our organization?
Often when we look at edge discovery,
we look at the overall perspective of the router on the internet.
What is the edge of our network?
In most cases,
it's going to be that one single router with
redundancy at the edge of our computer network.
This logical device that provides network address translation is the
D mark between us and the rest of the world.
And we need to identify it to adequately protect.
Edge discovery is the process of understanding how much of the
information the attacker can gather from that edge point of view,
whether it's the router or the server proxy.
We need to understand what can the attacker see within
our network from the edge on end into our organization.
And how do we eliminate their perspective of
seeing all that information inside of our network?
We can often use security control testing to identify
and eliminate certain controls within our, within our enterprise environment.
We often look at security scanning and we scan our assets,
which we've talked about before.
We do a risk assessment, vulnerability scanning.
We can also do what's called penetration testing, security auditing,
ethical hacking or even a posture assessment
to find out how is our organization doing
in comparison to where we would like to be
all these scans and tests that we perform all have the same function in mind?
How do I eliminate as many of the attack vectors?
As many of the vulnerabilities accessible from
an outside threat is humanly possible.
And now I said outside threat,
but we also have to be looking at our internal employees as well.
It's not uncommon to have an internal employee plug in a USB drive or get
mad at our company and decide they're
going to attack us from a different perspective
inside of our own network. How do we identify that and how do we deal with it?
Pen testing or penetration testing is
utilization of hacking to identify different
vulnerabilities inside of our network and
take advantage or exploit those vulnerabilities.
A pen testing is a contractual agreement between
the organization and a team of pen testers,
whether inside your own company and hired or outside your company.
Ie a third party to evaluate your network,
evaluate the vulnerabilities and then go through and actually exploit them.
Their job is to take an outside look of your
organization and figure out where your weakest inside your stance.
They ought to require a scope of work which clearly identifies
what they're allowed to do and what they're not allowed to do
certain things that they may not be allowed to do is maybe social engineering,
your employees,
maybe you as an organization don't want your employees dealing with that
and it could provide some legal parameters or legal problems for you.
There was a pen test created in Texas years
and years ago where a pen testing company went through
and they were hired by a city to perform
a pen test on their organization's uh computer system.
They took it a step too far and broke into the physical
records room to show that they were vulnerable to physical penetration testing.
The cops got up to them.
They laughed it off, they showed their contract, however,
their scope of work did not detail physical access to their records room.
This problem within their contractual obligation meant
that they were actually charged and fined
for breaking and entering into an area they were not allowed to be at.
Penetration testing is very identified.
It is a very thin scope of work and is clearly defined with what they can and cannot do
if you're interested in pen testing. One of the first things I tell everyone,
go get a lawyer,
make sure they're reviewing your contract and
make sure you're being legal about it.
It's very easy to cross that line and end up in jail. If you're not careful,
bug bounty programs offer an efficient method for
rapidly identify vulnerabilities through a crowd source approach.
There's many companies that have bug bounty programs within a bug botty program.
You often go to their website, you sign up to identify yourself,
you fill out some paperwork and some emails you correspond with
them and then you're certified as a bug bounty tester.
Once you've identified, you then go through and test their website.
Now, a bug bounty is sort of a penetration tester
perspective, but it's much more crowd source. It's much more open source.
You can test their web applications, you can test their internal systems
if you have permission again,
make sure identifying what your scope of work includes with a bug bounty program.
Once you've identified a flaw, you're
obligated to turn that flaw over to them.
And in return, they pay you for identifying the flaw.
This
often occurs where the higher severity of the fly
is or the more technical the flaw is,
the more money they pay you.
It's not uncommon to have bug money programs
in companies like Tesla or even Microsoft.
Now,
I would look on those websites and make sure they're still active before
I go out there and start randomly testing or performing web penetration testing
on their
mobile sites.
You could get yourself in a lot of trouble with different legal problems.
Reduction of the attack service to a
system organization is paramount for any organization.
We want to do surface reduction.
For the attacker's perspective, we want to do control testing.
We're testing how it works.
We're testing, hey, what does the attacker have access to?
What can they see as much of that attack service that we
can eliminate or eliminate is good for us as a whole?
We want to do vulnerability assessments. How is the vulnerability interacting?
What can the attacker
as far as vulnerabilities go?
Can I eliminate all or as many of those vulnerabilities as possible?
A vulnerability assessment can teach us those perspectives.
We talked about penetration testing, we talked about bug bunny programs.
We really want to understand what is our
attack surface and how can I eliminate that tax
surface that people can't see what my internal work
is in my programs or my infrastructure is.
But this goes beyond just our enterprise environment. What about our gates?
What about our doors?
If I have a physical access into a system that
I've eliminated all the technical approaches that you can handle.
I had a company that I worked for where their
server room was at the bottom floor of this installation.
And at the time, we had employees that smoke
to get into our building, you had to go through a gate and that gate had a problem.
It was often broken. People were always working on it.
It wasn't uncommon in two or three days out of the
week to have that gate wide open with nobody guarding it,
no pin code required,
but it would usually be fixed by the middle of next week only
to have it break again another week and being standing wide open.
This was a problem and it opened up our attack surface.
Once you went in, you went into the parking lot and you had to go through a gate,
you had to key card yourself into the main entry point.
There was a security guard standing there waiting to take anybody
that didn't have the proper code or the proper identification.
We have vendors showing up all the time and
it wasn't uncommon to have a vendor come in,
identify themselves and then meet with somebody
to have them take to the appropriate
building or the appropriate office to meet with the person they were going with.
However, you could easily tailgate in those areas.
I remember one time I was literally carrying two or
three boxes and somebody just let me write in,
I had no idea who they were and the security guard didn't even
check my verification of my ID to make sure that I worked there.
Now, I had seen that security guard two or three times.
So maybe he saw me, maybe he didn't.
But the fact is that the main, that he didn't check my security credentials,
I could have been fired yesterday or even two or three
weeks ago and he probably wouldn't have been the wiser.
The problem is,
is that I didn't have to go through any of that
if I wanted to break into the company's server room,
because on the back door,
smokers would often prop that door open so they could easily access the building,
smoke their cigarette and then they would just leave it open.
nilly, especially during a nice spring day.
So without having those controls in place,
I've opened my entire server room to physical access,
physical access means that I can bypass firewalls. I can bypass
ids's, I can bypass billions if not billions of technical controls.
Just by plugging the USB into the server.
This is a problem.
We need to identify all attack surfaces and make
sure our policies are being followed to the tee.