Comptia pentest chapter 1: What is it?

Two federal laws applying to hacking

Title 18, Chapter 47, Sections 1029 and 1030 of the Computer Fraud and Abuse Act

Title 18, Chapter 47, Sections 1029

Fraud + access devices: any device that is created to generate access credentials

1030 of the Computer Fraud and Abuse Act

Fraud + activities on computers/device that connected to network

Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies Law

Used tools for pen Testing, for malicious purpose, so this laws clarifies on that

NIS Directive (Network and Information Security Directive

EU-wide cybersecurity law aimed at improving the cybersecurity capabilities of EU member states, critical infrastructure operators, and digital service provider

In Japan, the APPI (Act on the Protection of Personal Information)

governs how personal data are collected, used, and protected

Canada's PIPEDA (Personal Information Protection and Electronic Documents Act)

regulates the collection, use, and disclosure of personal information in the course of commercial activities.

Privacy law: Stop Hacks and Improve Electronic Data Security (SHIELD) Act

law that was enacted in New York state in March 2020 to protect citizens' data. The law requires companies to bolster their cybersecurity defense methods to prevent a data breach and protect consumer data.

Privacy Law: California Consumer Privacy Act (CCPA),

it outlines specific guidelines on how to appropriately handle consumer data. To ensure that customer data are adequately protected, vendors should include PenTesting of all web applications and internal systems along with social engineering assessments.

Privacy Law: HIPPA

a law that mandates rigorous requirements for anyone who deals with patient information. Computerized electronic patient records are referred to as electronic protected health information (e-PHI). According to HIPAA, the e-PHI of any patient must be protected from exposure, or the organization can face a significant fine.

Pen tester must always obtain permission before testing because….

to ensure confidentiality of sensitive data, and avoid causing any harm to the systems or data. Adherence to a professional code of conduct, such as those outlined by the Council of Registered Ethical Security Testers (CREST) or the International Information System Security Certification Consortium [(ISC)²], mandates honesty, integrity, and respect for privacy and laws, ensuring that testers act responsibly and ethically throughout the engagement.

Steps for Pen testing: 8 Steps

1. Scope Define; outline which systems/networks and application are tested

2. Authorization

3. Objective setting; goals/objectives of Pen test

4. Rules of engagement; acceptable testing methods, times and conditions

5. Risk assessment

6. Confidentiality Agreement

7. Contact Information

8. Pre-test checklist; timestamps, backups, notification of affected stakeholders, and montior

Tools to manage documentation: Dradis

Open source framework that ensures that everyone is working from the same info and its templates enforce consistency

Tools to manage documentation: Faraday

Real time collaboration, supports multiple pentest tools to a single platform + stream lime documentation, reports, tracked consistency

Overview of PenTest Report

1. Executive summary; key findings/sum/risk/recommendations

2. Methodology; tools/techniques/procedures used to perform Pentest

3. Detailed findings; flaws, vulnerabilities, misconfigurations

4. attack narrative; steps taken to exploit vulnerability in a system/network

5. recommendations

Role: social engineer

focuses on human elements, utilizing tools like phishing frameworks (e.g., Gophish or Social-Engineer Toolkit) to assess susceptibility to social engineering attacks

Role: Red Team Member

simulate advanced threats and attack scenarios to test the organization's detection and response capabilities. They often collaborate closely with PenTesters, exchanging information on the tactics, techniques, and procedures (TTPs) used in their engagements.

Role: PenTester

conducts technical assessments, employing tools such as vulnerability scanners (e.g., Nessus or OpenVAS) to identify weaknesses in systems. They work closely with the project manager to ensure alignment with the overall objectives and give regular updates

Contacts: Primary

party responsible for handling the project on the client's end. This is usually a CISO or other party responsible for the major decisions surrounding the penetration test.

Technical Contact

party responsible for handling the technology elements of the activity. This could be the IT security manager or the network systems administrator.

Role:Stakeholders

spell out all requirements and agree on the terms before testing begins. Stakeholder alignment involves ensuring that all relevant stakeholders within the organization are informed, engaged, and aligned with the objectives, processes, and outcomes of the penetration test.

Understanding the restrictions

1. determine allowable tests

2. scope

3. recognize other restrictions

4. limit based on scope

5. limit the use of tools based on outline

Root Cause Analysis (RCA)

plays a crucial role in a penetration test by helping to identify the underlying reasons or systemic issues that lead to security vulnerabilities or incidents.

What is final step in PenTest report?

Documenting RCA findings

Escalation Path in Statement of Works (SOW)/project plan

communications provides clarity on who should be contacted within the client organization, streamlining communication and ensuring that relevant stakeholders are kept informed.

Chain of Custody

logging every transfer of data, including who accessed or modified the information, the time of access, and the specific changes made.

Risk

consequence of a threat exploiting a vulnerability.

Formula for risk

Threat x vulnerability = risk

Threat

represents something such as malware or a natural disaster that can accidentally or intentionally exploit a vulnerability and cause undesirable results.

Vulnerability

weakness or flaw, such as a software bug, system flaw, or human error. A vulnerability can be exploited by a threat.

Risk analysis

security process used to assess risk damages that can affect an organization.

Unified threat management (UTM)

Vendor offering cloud services like PaaS, IaaS, SaaS

Risk Appetite

security process used to assess risk damages that can affect an organization.

Risk rating

he process of assigning values to identified risks. This is usually done by following a reference framework, which is a method of consistently rating findings.

Goal Reprioritizations

process of reassessing and adjusting the testing objectives and priorities based on emerging information, unexpected findings, or changes in the organization's security posture.

Business Impact analysis (BIA)

involves estimating the possible effects to the client if the issues identified during the activity were to be targeted by a malicious actor. It aims to understand how these vulnerabilities could affect the organization's ability to conduct business and achieve its objectives.

Cost Benefit Analysis (CBA)

effective tool to help prioritize remediation efforts and demonstrate the business value of addressing vulnerabilities. T

Open Source Security Testing Methodology Manual (OSSTMM)

structured methodology for conducting security testing in various environments, including network infrastructure, web applications, wireless networks, and physical security.

PTES (Penetration Testing Execution Standard)

collaborative effort among security professionals to establish a baseline for performing penetration tests. Like OSSTMM, it is community driven and open to contributions from practitioners.

The framework is updated based on community input and evolving industry practices, allowing it to stay relevant and practical.

Council of Registered Ethical Security Testers (CREST)

nonprofit organization that serves as an accreditation and certification body for the cybersecurity industry, particularly in the field of penetration testing and related services.

Penetration Testing Execution Standard (PTES)

well-established framework that provides a comprehensive process for conducting penetration tests, from pre-engagement interactions to final reporting.

1. Pre engagement interactions

2. Intelligence gathering

3. Threat modeling

4. Vulnerability analysis

5. Expoloit

6. Post-exploitation

7. Reporting

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge)

comprehensive knowledge base developed by MITRE Corporation that describes the tactics, techniques, and procedures (TTPs) used by attackers during cyber campaigns. It provides an extensive framework for understanding and categorizing the various stages of a cyberattack, from initial access to data exfiltration.

Steps in MITRE

1. Initial access

2. Persistence

3. Credential access

Open Web Application Security Project (OWASP)

is a widely recognized document that outlines the 10 most critical web application security risks. OWASP is an organization aimed at increasing awareness of web security and provides a framework for testing during each phase of the software development process. OWASP offers free documents,

OWASP Mobile Application Security Verification Standard (MASVS)

framework developed by the Open Web Application Security Project (OWASP) to provide a comprehensive and consistent set of security requirements for mobile applications. The primary goal of MASVS is to help developers, architects, and security professionals ensure that mobile applications are designed, developed, and deployed with appropriate security measures in place.

Purdue Model, also known as the Purdue Enterprise Reference Architecture (PERA),

is a framework traditionally used in industrial control systems (ICS) and operational technology (OT) environments to segment networks and enhance security. It divides the architecture into six levels, each representing different functionalities and systems within an organization, ranging from the physical devices at the lower levels to the enterprise network at the higher levels.

Purdue model; level 0

Physical process— Sensors, actuators, and other physical devices directly involved in the industrial process.

Purdue model; level 1

Local control—Devices and systems that interact directly with level 0 devices.

Purdue model: level 2

Supervisory control—Supervisory systems that manage and monitor level 1 controllers.

Purdue Model; level 3

Operations management—Systems that manage production workflows and operations.

Purdue model; level 4

Enterprise/business planning and logistics—Corporate IT systems including ERP (enterprise resource planning) systems that handle business-related data and operations.

Purdue model; level 5

Enterprise network—Higher-level business functions and network connections, including external communications.- OT/IT environments

Damage potential, Reproducibility, Exploitability, Affected users, Discoverability (DREAD)

Damage potential, Reproducibility, Exploitability, Affected users, Discoverability (DREAD)

Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege (STRIDE)

is a structured approach for identifying and evaluating security threats, making it a valuable tool during penetration testing. It can help in prioritizing the most significant and likely threats, optimizing the use of resources. STRIDE is an acronym that represents the following security threats:

Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)

risk-based strategic assessment and planning technique for security. It is designed to help organizations big and small to understand and manage their information security risks. Developed by Carnegie Mellon University's Software Engineering Institute (SEI), OCTAVE is tailored for organizational risk management rather than focusing solely on technical vulnerabilities. OCTAVE involves three different phases: