Social-Engineering
Hacking a mature security program
…
Strategic Penetration Testing
Dave Kennedy (ReL1K)
http://www.secmaniac.com
A Mature Security Program.
• Companies have invested a significant amount of money on
securing their information.
• Application Security, Data Loss Prevention, Vulnerability
Management, Monitoring and Detection, Event Correlation….
2009 to 2010
• Security conferences
reported record numbers. • Security staffing
decreased...then increased.
• Estimated 1 billion spent on
2008 Breaches (PrivacyRights.org)
• In 2008 there was a total of 354
reported public data breaches.
• You might remember this one:
2009 Breaches (PrivacyRights.org)
• In 2009 there was a total of 252
reported public data breaches.
• We got better! … Wait?
• Largest breaches in history, largest
amount of records disclosed, large amount of PII, PCI, PHI disclosed in one year ever.
2010 Breaches (PrivacyRights.org)
• We spent so much more this
year… Estimated 34% increase on our budget.
• In 2010 there was a total of 594
reported public data breaches. Over double that of last year.
But we got better at detecting…..
• Out of the 594 reported, 74% of them had been compromised
Compliance
• Companies spend over 40% on compliance driven security (Forrester).
• Compliance makes up on average roughly 14% of the companies “sensitive data”.
What the heck happened?
• 11 years ago we discovered SQL Injection.
• 34 (before I was born) years ago we discovered buffer
overflows.
• 1.6 million years ago we discovered
But buy this, it will fix it.
But buy this, it will fix it.
But buy this, it will fix it.
But buy this, it will fix it.
But buy this, it will fix it.
But buy this, it will fix it.
But buy this, it will fix it.
But buy this, it will fix it.
But buy this, it will fix it.
But buy this, it will fix it.
But buy this, it will fix it.
You get the idea….
I bet the majority of these had a security
program…
• RSA, a mature security program?
• Sony, a mature security program?
How are we identifying the exposures?
• What are we accomplishing during a penetration test?
• What are we doing?
I bet the majority of these companies had
pentests..
• I bet RSA had a number of
penetration tests performed on a regular basis.
• MySQL gets hit with blind SQL
injection? Comon…
• Most of these companies probably
have dedicated personnel to security.
A Mature Program?
• I haven’t seen one yet….
• I know I can compromise any organization I want.
• I know I can take everything they own and run
How to fix failing..
• I’m not saying that
penetration testing is the savior.
• I’m not saying
everything’s bad.
• What I’m saying is we
can be doing so much more….
We need…change?
• Penetration testing needs to focus
on our riskiest areas we do business.
• Needs to be aimed at stealing
learning the organization.
• Understand that penetration
testers have a week or two max, hackers have months.
Away from risk formulas and
Complexity
• I could be crazy but we have made security so complex we
have no idea what any of this stuff means anymore…
An attack targeting the companies
ability to generate revenue.
The Penetration Testing Execution Standard
(PTES)
• Aimed at tackling the weaknesses we have
right now in the penetration testing industry.
• Focused on identifying and understanding
what we want to accomplish during a penetration test.
• A clear path to mature your information
Why this is different…
• We know what we need to do in
order to fix this industry.
• Collectively we can tackle the
issues we see today and what we see coming in the future.
Maturity Model
• Not every company is ready for each level of a penetration test.
• Understanding a companies security appetite maturity is
assigned based on a level in PTES.
• These levels should increase as the company increases their
maturity.
Pre-Engagement Interaction
• Aimed at learning the organization that your
attacking.
• Finding out what the company does and what
they are getting out of it.
Intelligence Gathering
• By far, the number two most important step in
the entire penetration test.
• Learning the organization and how they work.
• Finding what your best attack vector is going to
Threat Modeling
• Finding our best route into the organization that
will have the most realistic impact.
• What are the keys to the kingdom? Trade
Vulnerability Analysis
• Notice I didn’t say vulnerability assessments.
• Understanding what vulnerabilities may be
present and doing your research on the best and viable attack vector.
Exploitation
• Precision strike,
something you have researched.
• Confidence and not
brute force method.
Post Exploitation
• Arguably equally as important as intelligence
gathering.
• Identify the key systems to inflict maximum
damage or loss.
Reporting
• Often where we struggle in security.
• The most important message is
through reporting.
• This is the number one most
important step of a penetration test and one we dread writing. Why?
Emphasis on Communication and
Education
• We need to teach.
• We need others to
understand.
• That’s the only way
to be successful at this.
We are all about the hack.
• This presentation showed some breakage.
• This presentation showed hacking and
zero-days.
• But this presentation was designed around
We are all about domain admin.
• Guys and gals, domain admin means squat.
• Focus on destroying the company, focus on
impacting the bottom line.
• Learn the company, hack it, and make them
The blame on many
• It’s not just penetration testers to blame.
• It’s companies, who just want that check mark
and don’t take the time to learn security.
• It’s the high level big picture companies who
couldn’t secure your organization let alone their own.
We are all smart
…
• We are equals, I’m not smarter than anyone
here.
• I may have different experiences, but working
together with each others knowledge, something can actually happen.
• Support PTES, preach PTES, contribute to
Again
…
.
• There’s a lot more to security than penetration
testing.
• I’m not naive into thinking this is the only thing
we need to do to fix security.
• But this has got to change for us even to
Going back to the basics..
• Stay away from the shiny toys that vars sell
you.
• Stay away from that magic bullet that will fix
all of your problems.
• Think about what your doing and why you
The Big Picture
• Penetration testing
aside…
• Look at what makes
your company money, how they do business.
DerbyCon
• Three day conference with
training
• Insanely stacked line-‐up
• September 30 -‐ October 2nd
• Louisville Kentucky -‐ Hyatt
Regency
http://www.derbycon.com!
