In this lesson,
we're going to talk about reverting configuration changes
after a PenTest.
When conducting a PenTest,
you might have to alter different configurations
to test vulnerabilities or exploit certain systems.
It's important to revert these changes
to maintain the system's integrity
and pretest baseline
to prevent any unintended security gaps.
Let's start with the basics
of reverting configuration changes.
During the PenTest,
you might modify firewall rules
to allow certain type of traffic
or disable certain security settings to test export.
For instance, you might open port 8080
to see if a web application running on that port
is vulnerable to a network attack,
such as a SQL injection or cross-site scripting attack.
Once the test is complete,
it's important to reverse the firewall rules
to its original state to ensure the system remains secure.
Make sure you document the original settings
before making any changes,
and use the documentation
to restore the firewall configuration accurately.
If you're in a virtualized environment,
creating a snapshot will be very useful here.
Another common configuration change
involves modifying database configurations.
During a PenTest,
you might alter database settings
to test for vulnerabilities.
For example, you might change the database access controls
on an Oracle DB to allow more permissive account access
during testing SQL injections or other database exports.
Reverting these changes
ensures that the database is protected
against future unauthorized access and potential exports.
Sometimes you may make configuration changes to logging
and monitoring systems as well.
For example, you might disable certain logs
to avoid detection during the test.
After the test, it's essential to re-enable these log
and ensure they are functioning correctly.
This includes verifying
that all necessary events are being logged
and that log retention policies are restored.
Doing this ensures that the monitoring system
is fully operational
and can detect any future security incidents.
Configuration changes can also involve system settings
and application configurations.
For instance, you might disable certain security features
like encryption or authentication mechanisms
to test specific vulnerabilities.
After the test,
you need to re-enable these security features
to protect the system.
Documenting these changes beforehand, again,
can help revert them accurately and quickly.
And lastly, another common configuration change
involves modifying DNS setting.
During the PenTest,
you might change DNS configuration
to direct traffic through specific servers
for testing purposes,
like capturing and analyzing network traffic.
For example, you might alter the DNS server settings
on a system to point to a controlled DNS server
that logs all the cures for analysis.
So after the test,
it's important to revert the DNS settings
back to the original state.
So remember, reverting configuration change
is a vital step after a PenTest.
By carefully documenting and reverting firewall rules,
database modifications, logging and monitoring settings,
system and application configurations,
and DNS configurations,
you can restore the system up to its original state
and ensure it remains secure.
This thorough cleanup process help prevent
any residual security risk from the test
and maintains the integrity of the system.