Network Security & Hardware - eWeek


Battery 500 Project Charged Up over All-Electric Cars
Charting the Final Frontier--Google Maps for Indoors
Get Smarter Technology on Your Mobile!
  Network Security & Hardware


RFP: Penetration Testing



 By: Cameron Sturdevant
2007-07-09
Article Rating:starstarstarstarstar / 2


There are 0 user comments on this Network Security & Hardware story.


Rate This Article:
Poor Best
Penetration testing is a good way to determine what weaknesses may be present in an organization's infrastructure. Here is a basic request for proposal that can assist with identification and remediation of security risks.

Penetration testing, which involves probing applications, operating systems and device configurations with the goal of gaining access to protected data, is a good way to determine what weaknesses may be present in an organizations infrastructure. This is among the first steps an organization can take to systematically eliminate risky configurations before attackers can exploit these openings.

To identify the right solution when creating an authorized hacking or pen-testing request for proposal, security administrators should have a good understanding of the risks the organization desires to mitigate, the business processes that will be probed and the level of security that will be tolerated to attain security goals after the pen tests are completed.

Thinking like a hacker is an effective method to ward off attacks from malware writers. Click here to read more.

Here is a basic RFP that can assist with identification and remediation of security risks.

BUSINESS BASICS

  • Pen-testing services and security consultants are only as good as the research teams and test probes that stand behind them, so its important to get a good read on the vendors and services providers under evaluation.

  • Besides pen testing, what other services does the organization provide? (More answers, especially those not directly related to security, are not necessarily better.)

  • How many years has the organization been engaged in pen testing?

    Resource Library:

  • What automated tools are used to perform the test?

  • Is the vendor or security consultant under consideration a security reseller? If so, what makes and equipment do they resell? (If the priorities of a given pen-testing vendor appear to be focused more tightly on pushing product than on offering an objective assessment, youll do best to look elsewhere.)

  • Please list the background and years of experience for the principals of the test organization. If possible, provide a curriculum vitae for the consultants who will be assigned to this project.

  • Does your organization use a methodology? If yes, does the methodology correspond to or exceed that of the Open Web Application Security Project or some other outside authority?

  • Can the organization provide customer references?

  • What is the organizations policy on confidentiality?

  • Does the organization use outside staff for engagements? If so, what contract for confidentiality is in place to protect penetration results from disclosure?

  • Is the organization bonded? What does the standard contract include to ensure privacy of test results?

    PEN-TESTING TOOLS AND METHODOLOGIES

    Security consultants often use a combination of pen testing, scanning and vulnerability assessment tools. It is important to know what tools will be used and the possible effect the tools could have on your network and applications.

    Like many drugs, pen-test tools have side effects that can be unpleasant. It is important to keep in mind that the results of a well-run test often outweigh these side effects. If no loss of productivity can be tolerated, then a pen test should not be run. However, this in itself could indicate other serious network, application and system management problems.

  • What tools will be used to assess our organization?

    • Core Security Technologies Core Impact
    • Metasploit Project
    • Tenable Network Securitys Nessus Vulnerability Scanner
    • eEye Digital Securitys Retina
    • Mu Securitys Mu-4000 Security Analyzer
    • IP protocol analyzer; if yes, please specify.
      • Insecure.orgs Nmap
      • Qualys QualysGuard
      • Snort, Sourcefire 3D System
      • BigFix Platform
      • PatchLink Scan
      • Rapid7s NeXpose
      • Cenzics Cenzic Hailstorm
      • Others

    How do you turn a small group of security pros into an organized online crime group? Read the six rules here.

  • What platforms can be tested?

    • Windows desktop operating system (Windows 98, Windows ME, Windows XP, Vista)
    • Windows Servers (Windows 2000, Windows 2003)
    • Unix
    • Linux
    • Apple
    • Mainframe

  • Describe basic techniques used to enumerate target systems.

  • Describe basic techniques used to footprint target systems.

  • What pen tests can be run against the target?

    • Operating system
    • Network
    • Internal applications
    • Web applications

    Learning to think like your most common opponent isnt that hard. Click here to read more.

  • What reporting services are provided at the end of the test? ( (Provide sample reports of actual tests.)

  • What remediation services are provided at the end of the test?

    Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.



      Reader Comments: RFP: Penetration Testing
    >>> Be the FIRST to comment on this article!
     

     
     
    >>> More Network Security & Hardware Articles          >>> More By Cameron Sturdevant
     


    • xr80VӮc]mT![rYӶT婎PP$$Mz%Ο 7]hɗ%L$D"λ$i9rsݙkj֢w.? Yf8mTE[\ߤ~Am;t =4mMFNHB8 \?g3U;Y|vP /T|0tgL'þ=a> e%k4ExL>vn3 w2 w:aq:xp@FkMmWVekF֠}l!6 ȅC׷0T݉[ݛ L4IձHfI%p'z:rm3k> NZ] Z3tt=POMҷB]L1H6}D?&Q Ig6qOz^_'@;)| uȭzk߀#ݸ1ܷL[FQKXMDV6'>6L) |HCɤ:QԧFq9e,f4öCCٰo5RrXJyy/^+Y-\h7Fso3j/B(֝h m+Va(λW~d@.z:ggQ@ Xߠd}#5*%`ZJ4/ ZHNVP? uΑkQ2[-Kj%٥~hY̞ofVҘ gUUYA[~6t.˫nCӣn;l,aV4*2V]鮘ȏAժ}|qݽhwEڝONY; i f׵V:'^=:$lrK,.iTW%vxC!u{L ,_e=h!_w nr@ i/]"{,Y`MImdƩ$|S@kNXѬ[cW)MZ!rƒ u$u(7hr Q@e)#p?S݇IhJq䨉k>ذ 1"%̟hJyO{Ջ"}Et"Aͩ8 (J!bV3tɋ BD4?CC7=aB+Y,h."e-CjY[6'jtamI՘iS_eޡ:I5xieO~S35ލhX.B2i%!g8W5MGVOLTf~X}U9=zQnũl :2X jXR7XaQp6 0hv3Ϩig89yt$ࠣM/C˥yj1@ L^0i|+wOݺzL^TŞ+LКk}0#GE 6 &>qP`2Z9ܹ L& 0 `Dy+л#i`y1&=զA{ Tgxs=w}  {` ޚꖭ,L<ħܠ{ԁ.q<ɜ+) -P cRRR$S !hI#r Bг,`@o%``[X;;.V+\y"*M':܉;T+Jd&3,BV-KїPf%i2klƪń(VFN1|(0Vn)5BYQ9Cסs#O/0p#q"L)32,Xh&l:Z7EQwԽ#SBh&H00UEyBf,4V(fsᠺ4S}52{B`ass2r|I45+8dp; y_ܼ? b>ȝ 8#_gMY1Q)OzBaexʸ**$,T4ŠptjKwCݼ~h"é;hqNNSНB#D9zQ=/OJb-yhֽ(UעoH_ƠR. B[+Ҟ K r%W}kaԕ %/DAn6\Z1,c l,>4AdN/a:*)6Pb8dOÈ~G*+ #SLo^viz\6`aPeQ@ҿR&a+B֨N`Oci6EGzwH~uf:s?'نdp$DhS+}ne@IuU[13R%<T2.Q\&V,'`##NW酥k?t'[B`VA`Ng43aJ[6 ~XGM{R^ /0ktg gjE)jB4'P/#[յ /S+wڶ{Ot]QGXZ1B-g @?QQ>5 \!EX+̂L׃RUad[s5/zVwdNp+\qW["LJ}ܑe Nl*I qۻ(Se&;Ql˘ʓ@/-c)gpIl_ÀpɥK-ޫp)cZ$ c`׊._kOWrB ['ɂXw hO7`sc'(k=z&:pJTnЬ 0ԴgKZ/V̌k}P~n`7,mC[$ zTÈh;qņZ ZYMvq q?zo|렄6RiMxޜ9"yea@WIlJhL[+XJ/Mи6>s875ϣJ! p]'8 o~Qjy6UG3>dߊ'z!k!@j-%r)zĀTϊh{ ~zUMe2YhSYpg#ؚIu9*<+u05u 2 \FzďtfY uLzW!SB91^%Lwܒ; k@X'W-(7ϙ40pR2Y=+lY|_ۯ|6ci4DZ6vVSR+̍ⲟq#oqS(j :H$ <,#8jK#ߪ 靦nɕG: aIuRTT]\~T#U\+ԊR/YT^%vdi&d9L5Ll'P`P(S&L]8۴TV<^ۋC9537AHLf@= P3t^iW:Zky*1`2I8{`5\צLDu Z:LT)7OLKZ^$|p`쑉Ee2q{h7(j-/$x4Hđ;wk~ʡnU o>eM+v@lkZpwG2M#gD!)Wje>eѓeO.lWJ_0]HX9H(P+,rޏGɷonjC<8 +An)ɑ$>QkfR12a7ZTe3111u?|{~qwo%bm + =|Y+ t;?\wۃR>Ib λg ?Nn00N N0+ LӀoRX-u[:b4 L@IP 4p=$.&#O^E^銿z=;  Fk;r zyCB|};]Sz{ёX'Kփ 7YBVç}8zd ,Fsd3D?yiВ11>onP;-4zݷP%(bAcIU~(TR-.aO"J骇\v%(c]MU,^RRMJ>^%k@"@{.ۥ{HkYXdbSOٞo ?֘ '|Ȟ}Աىƣsd!,d_aзF0[)=)$ΙំJ;ooFp7N Ϧf_ O%FJ ,Q`mZ،9a_к õQ`V: ?/%IFܱSo-*ߞ1;lT̈́3W7Op&5;U)&5!4y˭(LdT/4 FK[⹋^]:lMo %n!Й*Ͷn,CP|4*jEٗwBye sMǾrg&aIJ[ȏG;ZxTҚQ2 ϣv-&"̳̳|PK ot%5/rc4pX 1%G@DrZ_ǃnsZ/<ΘI Koe@KURO8ȷL;- H!V{xFv :IAgn!"NnSvrڶR%\;D0Fd c_|3g5ؑ7go CDwZ haBJLX@!!=I9=X83Ua]ьD]N|2,`P mY$0gLZ} "1tA$WNj.ƬuDib!:˷2jbvt4p[H&G8̹ T!gikR!&%8*aV j1yϝΉvRۍ%CnܲI'*%qJMmGk>e&K2埇]q"uW/* Z bEUXPTo,CzI$ /piM5F>-Ϲ&<"SYD(O˜NʹS3er3eX2hl5xJ<9 އ0qs&IReez…LwCUR|q~<,h[eϺ6#&4>ۏ= j#NJz&yF- ~bĶbZuz@8gh/Y%;C0(h㑴ߩJ0Q=U3).w͊'Rb*.bh0-JZ @x hDxD $na!"J=]HJ7DT&OQ]ü|-ߦ0t閃fHqOX^ ]_,!Ez_kh_SUeCf}`2 4E<t=S _-_*6޸͍>738r~021. @x$cy5d%LVx+$kWx#,rW8 ci"-F2q HV,fj,Iݓ|{[1`URjVݔ/>3՝K6uu1|`YR_L  N"ԺcA_HmM/AXPCs~YtKp0h F:~nU1@8`IOHk˟-pM?pDW%ї23b×%ID {ܬVTlҹ~C0/[T`s1˖w<30_AuQ YMmX[Wܺ.СWsGjq[c D|p{?Qn*{奆HH1>Ly(i0g<aj.*`# <B.}; hayUO~uCΪ$R )ThLXeUMjE71^Vs]ɆW{[/"жB<v̚HSzu2seJxCx̢7zbA[ף溒TWn/4% Ike\)X<x`@}EP[#ؿ"=0]j;nt34t _k_A'-gm̬jgϡ6 %<{>e QYH鎸`-1_CXgCя`* n'y{Hdb1K#M.b m0By u&MߥԟSWG~RJq'd<u'y|`'m"Dcঐߥ~s*r'H BvMxrwٵ&?_U]{N9- 䩩r~',z)ŢW\#.kjc@4#zB@]o7,BG?PM}яw >(8EP *=6i[<Kj*bdFyAx!Fvҏ;Kb+.A6Q;$Ih+jj5ʳA^91ckzzD,?tE/]Q|~4. db &6K ʹ<8?G 6MEfIȢDWZE\sI.jʾZrO?P/ .h^,aUd ޕlW1 {BZītTes[ɧj*r- iT&] x;#-5נ}6=j6j=!ɣ`5Ga.vD7|e|W@O[fkhP♛U֝UNؓRc-*);,'Bd-MeFI3ۡ5BYQזmbN4KsnMOBO .ړ{z^NzGV$؛ ~v-ރؖ r|jI_o6zqC{ڕOa{)D$RQV{{i ~HkkѱKQ=͝iә HuWIkmJ%ݫ9?2RmFέz_ar}sι}?sc Z%gev`w0̊ۼUd[hlowAQgg)cN>SKCсH5,?_J)k4_߈CϪI&q{V \#ٯGLaZ=#ZMIxe5J7[]|F| E3N(oɀ }Urt'7%eZS[ٓ98G Pm¼ϴDR )}o cb2zޘ8pb Y$ZaIm{d72[ $}2?Z,D1% Isꞑu3taa-d=:}GLB7q S* A=}9asH ]\W\Af'k:*!,՘,V?#7,>Oq75|$rkIC9ҌW}e_)a#{~#:́ ZPӊF2*mA_}&i[ք ၰ 5"  B[ cc(mDRR'`" a9=g3bw + #m:݋x.(cZ|G"ʆ%^#&3)-+yho@QR*G( *@`g*#sn Q&@Ԕ͍$u~kvK .X`'tA"\2,Gyan2x :Q̬Dzy 6t(QS=1U&FǮ,nN ىrPh$`x=9~imƅta~X{SdO (  @Ka1c~Po֔J$2 >*%>gٕa)XU+Fy/CX&*_iJdR. ?h$@쌆=xɾx t0 c3brLuf&ZgIUCWAwA:gk<m-j=:GE{1(4O,fbv>4m+LxteAN.Zf)L3\h^E,^;K#8/f^ӝ'Q~=B)Qe3 \VCĸҫSe0L8NS+t?gg:^Y9vM/ǭoj4}V0<- (hO1u.:fdRR3`dz_לߠ+(Z_~NmS>X_;9P~sC?|Oiw}y]hv9_7?t/rn _9埡3fyCs}s{9ϡ9<9yyß(9rO4Ps(?) z_z92?.˜r7_?}OP))~rw y9{ _ wNr!(oYNoR8G9B(_*Uy@a uqS9@yJ*,c/s\-ϑ*s;[?u/{BX\jvr+^vfe5vkYAN;/6R^a/ ^dopO {`^ thcЁxNi41kHl7g@oJ`Xkt(JV7Bg3Σ؞3׌5sdž`{GaiЄ.^p멎TgU|A>cx L65'T4?_vs[>/R`E G8&U]#66sQ/uKW}Q'na|d[t%K^FzH%!Ҷ\)Vc%pCVxf:PEXl+QW5`/=H_(|9N]RjãÍGXǸ [) Iy>p <Щ0T\bսJʶE=b농 ѨipKTVDnS^-S7qݼSQa[O_<.FP1W ?&Il}MX<^|cwϏq`2Y= i>2#" $$jVI;;Q0&iE-ȓl`Cv_)<8- ciĬ;acXJXF!& ?O80Ux|-h\l}[xtmx0#Ÿrz,ŀ~U´Bd+KWԵ1%X^5FElT$bB}AH~Ð!goh=5nBM]&DWK54Ƙb{YL+cڅGSE6:|,݈bVS"NdJҗnrmmc{ Q }fbGn܌aBbv L%Fg% S^೐b,/A-xr&r*]xD4;NbŠәd_yfO1,#6ŠN|]t1Nʓ@:iw>J{`g~NTvQKeS!voǝE6̈́ В]&ŮMvbesD0")