In this lesson,
we're going to discuss target prioritization,
a key aspect of penetration testing
that ensures your efforts are focused
on the most significant vulnerabilities.
Effective target prioritization
involves identifying high-value assets,
recognizing end-of-life software and systems,
and also understanding the risk
posed by default configurations.
Let's start with high-value asset identification.
High-value assets are the systems, data, and processes
that are most critical
to an organization's operations and success.
These could include customer databases,
financial records, proprietary software,
and any system that if compromised
could result in significant financial loss,
reputational damage, or operational disruption.
For example, a bank's core banking system
or a healthcare provider's patient record systems
are high-value assets.
Identifying these assets
involves working closely with stakeholders
to understand the business impact
of different systems and data,
often using tools like business impact analysis, or BIAs,
and risk assessments.
Next, let's discuss end-of-life software and systems.
End-of-life, or EOL, software
refers to applications and operating systems
that are no longer supported by the vendor.
This lack of support means no more updates,
including security patches, are issued,
leaving the systems vulnerable to exploitation.
For example, Windows XP and Adobe Flash Player
are well-known examples of software
that have reached their end of life.
Identifying and prioritizing these systems is crucial,
because attackers often target them,
knowing that vulnerabilities will remain unpatched.
As a penetration tester, you should scan for EOL systems,
and recommend upgrading to supported versions
or implementing compensating controls to mitigate the risk.
Now, let's talk about default configurations.
Many systems come with default settings
that are intended to make the initial setup easier,
but are not secure for production environments.
Default usernames and passwords are a common example.
They're often well known and easily exploitable.
For instance, the default login for many routers
is admin/admin or root/root.
Similarly, default configurations
might enable unnecessary services or use insecure settings.
During a pen test, identifying these systems
that still use default configurations is critical,
because these settings
are a low-hanging fruit for attackers.
Ensure that all default credentials are changed
and unnecessary services are disabled,
and configure security settings according to best practices.
To put this in perspective,
consider a scenario where you're conducting a pen test
for a medium-sized enterprise.
You begin by identifying high-value assets
such as customer relationship management systems
and financial databases.
You then scan the network and find several instances
of end-of-life software from a banner grab,
including Windows 7 and outdated versions of PHP
running on some web servers.
Additionally, you discover that several internal tools
are using default configurations,
including a few databases with default admin credentials.
Prioritizing these findings,
you focus first on the high-value assets,
ensuring that they are well protected.
Next, you address the end-of-life software,
recommending immediate upgrades or isolating these systems
to limit their exposure.
And finally, you tackle the default configurations,
advising on the need to change default configurations
and secure configuration settings to prevent easy exploits.
So remember, effective target prioritization
and penetration testing
involves identifying high-value assets,
recognizing end-of-life software and systems,
and securing default configurations.
By focusing on these areas,
you ensure that the testing efforts
provide the greatest benefit
in terms of improving the organization's security posture.
Prioritizing these targets
help protect the most critical parts of the business,
mitigate known vulnerabilities,
and also close easy entry points for attackers.