On 8/9/07, Yiannis Koukouras <d4rw1n@linuxmail.org> wrote:
>
> Do you think that an external infrastructure pentest is nowadays obsolete?
>
> What I want to say is that, most of the serious companies nowadays will only
> have a few >servers on their DMZ (web server, mail server, SSL concentrator,
> terminal server, citrix) >and will only allow access to one or two ports for
> each of them. The rest of the >infrastructure (excluding the internet facing
> router and firewall) will be completely >inaccessible.
>
> Thus, if web application testing is out of scope, there isn't much to test,
> is it? Only half a dozen of services to check vulnerabilities and
> misconfiguration, check if mail rely is on, make a password bruteforce
> attack(?), check that the DNS can't be poison and VOILA! You have finished!
>
> Do you think that it is ethical to consult our clients to "buy" an external
> pentest anymore?
>
>
> --
> Ioannis Koukouras
Hi Loannis,
External pen-tests are definitely not obsolete. In fact, I'd say they
are more critical than internal pen-test.
>From a technical standpoint, so what if the firewall could be in
place, at least some services would be exposed. every exposed service
is an attack candidate due to the vulnerabilities discovered in the
applications (FTPd, HTTP, ), there could be ineffective inbound rules
at the firewall...how do u uncover them without testing? Moreover,
there could be IP address spaces owned by organization that may not be
the most used ones (or monitored). Such "forgotten" IP address spaces
can be found effectively by pen test.
>From a managerial standpoint, an effective security policy is one that
secure, monitor, test, improve, secure, monitor.....
So without testing, you are breaking a cycle of hardening security.
If an organization thinks that it's current security posture is going
to suffice for future as well, then they need a new information
security team.
HTH,
--
Rajat Swarup
http://rajatswarup.blogspot.com/
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
|