One of the biggest questions that we ask ourselves inside of cybersecurity
pen testing and anything business related, not just the IT portion,
is why do we take notes?
And it's very critical that we understand the beginning middle of end of every
practice that we took along the way.
And this is where it starts time into the actual pen testing itself.
Pen testing is a very specific practice.
And whenever we go through and conduct a pen test on an organization,
it's critical that we keep notes because if a
vulnerability leveraging technique goes outside the scope of what we're
allowed to actually pen test, we need to keep meticulous notes on what command,
what tool, basically the five W's on what it was that we did that caused that
incident. Likewise, we need to make sure that we keep notes so that way we can
give an basic report of what actually happened throughout the pen test itself
in the executive summary.
And we'll be going more into the executive summary as we continue throughout
this skill. But what is it that we're actually covering inside of our note
taken? Well, basically the five W's.
So who, what, when, where, and why?
And when we take a look at those five W's, we're taking a look at who is it
that we're attacking?
Basically, who is it that we're working for?
Who is it that we're conducting the pen testing against?
And who is it that's actually with us on our pen testing team?
There's a whole lot of who involved in all this.
And what is it that we're doing?
Well, we're conducting a pen test, obviously, but what tool are we using?
What technique are we using?
What system or network scope are we actually going up against when we do
that actual pen test or wouldn't we use a specific tool?
When are we doing this?
Because this plays a big factor in what's actually going on on the actual
network itself.
Let's say we're actually conducting a network scan during peak business
hours.
That's critical information to know because some of the traffic that we
generate from our pen testing tools could potentially affect what's actually
going on during regular business hours.
And it could also reveal to us some vulnerabilities during peak and off peak
hours.
Let's say, for instance, we're running a vulnerability assessment against port
80.
And during the day when peak hours are at their highest, port 80 is being
utilized
the most.
And so you would potentially see more avenues of approach when it comes to port
80
on that particular threat assessment, maybe, maybe not.
Or maybe at night when nobody's paying attention to the web server, you see
more
there or less there.
But this is a big part of going into wind and depending on the agreement that
we
have with the organization, we're actually pen testing that plays a factor as
well.
We may not be allowed to actually pen test during peak business hours.
Good information to know though.
And that's why we log when this stuff is actually happening because it all
comes
back to time stamps.
Where are we actually doing this at?
Are we doing this in the actual building itself?
Are we doing this remotely from a different location that's nondescript in its
nature?
Or we actually doing this as a part of a collective for, let's say, Amazon
cybersecurity red team and they're doing a pen test against Microsoft pick one.
But the where in this is very critical too, because let's say, for instance,
you
decide that you want to run a pen test that's leveraging FTP servers and you're
doing it from outside the network perimeter of the organization with pen
testing.
Well, there may be different firewall rules for internal versus external
network
configurations.
And that's always a big consideration when we're going through and doing
different
types of pen testing and vulnerability assessments.
You may see things that are quote vulnerable from the outside, but are
completely different reporting on the inside.
And why are we doing all this?
Well, we're doing this because basically we're getting paid.
I'm just kidding.
We're doing this because we want to protect all of the systems and networks
that we're being contracted to protect.
And pen testing is a large part of making sure that we are fully defended
against cybersecurity attacks that are in real time.
Pen testers use the technique of best practice in real time in order to be able
to build defenses against those threats.
If we go in and we do a controlled and coordinated attack and the defense team
on the for the organization going against the pen test knows about it, there's
a
strong possibility that they're going to be well prepared for that attack.
Also, one practice to keep in mind too is that if you're pen testing yourself,
you're not always going to be 100% truthful in your actual reporting because
you may find it that there you may find that sometimes there are defense
personnel
out there that are a little embarrassed about letting people know some of the
faults that they had within their own system or network.
There's no shame in pen testing, but it is human nature that one of the biggest
concerns is embarrassment from the system administrator's part made in
some of those lines.
So we usually get a third party team that comes out and does all of that pen
testing because they have no shame.
I have no shame.
And when we go in and print out our results in executive summary form and go
back to the C suite that's actually contracted us out, we're not worried
about making friends on the inside of that organization.
We're just there to do a job and make sure that all vulnerabilities are either
identified or patched.