In this video we'll cover. What is
the importance of network penetration testing and
the need for it plus you'll also
understand how it helps organizations to
improve their security posture while preventing
future cyber attacks answer some
compromising the assets. So let's dive on
in
So what exactly is Network penetration
testing to put simply you have
various cyber Security Professionals within the industry such
as pantry contesters and ethical hackers
who uses similar techniques as straight
actors thread actors being the hackers or
the bad guys to simulate real sciotox
within an organization's Network
infrastructure with intention of discovering any
sort of hidden security vulnerabilities.
Remember security vulnerabilities
are simply security weaknesses
or flaws, which are found on
a system that can be exploited or
tea can advantage of by each doctor.
The objective of network pain testing
is to Simply find unresolve any
sort of security vulnerabilities before
a real hard case able to
compromise the sets of an organization, so,
What exactly are these assets assets
are simply anything that has value
to an organization assets could
be tangible assets intangible assets
and also the employees which is people.
Network penetration testing is simply common
security practice as it allows organizations
of any sizes whether it's
a large organization medium size or
even a large Enterprise. So these different
sizes of organizations are able
to do too many security posture as in
a current security posture of the network infrastructure
and also determine the
security risk of any sort of vulnerable tease
that will found within the organization. Imagine.
There are many companies are
many organizations that will create new
business process create new products create new
services or even try to reach new customers
Beyond borders by doing. So these organizations
will Implement new technologies such as
new computers new servers new
networking devices new security devices even
store data in different.
cases, what are your storing on Prem on a
local server or storing data on
the cloud however by implementing new and additional
infrastructure
Not much organizations May pay attention to
the security risks that comes with implementing these
new technologies. However, it doesn't
mean to see that implementing new technologies is
only method for creating new risk
with an analyzation. What about organizations that
has a lot of Legacy systems which are
still operating for instance. Imagine if
an organization has an outdated operating
system on a civil. Let's say the operating
system. It's let's say it's Windows silver
2003 and that operating system specifically
kept indoorization to whose
a custom built application. However, because
this operating system is legacy
and let's say it is end of
life. This means to see the vendor me not even support or
provide any sort of security update such
as security patches to this operating system that
means this operating system.
It is a huge risk with an organization. So
with network penetration testing, it
allows a penetration tester on ethical
hacker to determine the security
posture of the organization and
identify the various types of
restart exists together with any sort of security
vulnerabilities and the impact
overall Network penetration, testing
helps companies to determint likelihood of
being compromised by a real threat
doctor such as a hacker.
Together with improving the security
of all the assets within the company.
So why exactly do we need Network penetration testing?
Why should we perform Network penetration
testing frequently some organizations
are required to meet various Regulatory Compliance
remix and standards within
the industry simply to ensure their systems
are their networks are secure enough
to transmit anyone store data
data being the most valuable asset
or the most valuable thing to anyone on
any organization in today's world as simple
example is Healthcare Providers are
required to be HIPAA compliant hippo being
the health insurance portability on accountability
act to put simply hippo focuses
on ensuring patience information
commonly known as protected health information
and this is the medical
records or medical data that could be used to
identify person. So hip
Is designed to ensure that Healthcare Providers
systems Aryan networks are secure
the protect the Phi of their
customers such as a patients this
data if it is leaked anywhere, it
can actually compromise the patients.
Additionally there are
many organizations that provide payment card services
and solutions and these
organizations are required to be PCI DSS
compliant. This means it's a
payment card industry Theta security standard. For
example, if you work with an
organization, let's say you look at a bank that is UCP man
card such as a credit card Visa master
or any sort of payment card. All of this
systems are performing a transaction between the
user such as own of the payment card on
a processing system needs to be pcis compliant
to ensure this data is
protected during the entire transaction. However, being
compliant whether it's PC
idss compliant or even hippo being compliant
does not provide a 100%
guarantee on any systems
or Networks.
See that they are fully secured compliance simply ensures
a system or systems are
networks has met a baseline of
security features and controls to
protect data.
However, it is best practice to
also Implement additional security features to
ensure data is always kept safe
and protected from the bad people such as
a thread actors the hackers.
Network penetration testing helps many organizations
to find those hidden security weaknesses,
which are not always found during a
compliant audit or during a vulnerability
scanning tool.
However, Network penetration testing also
helps organizations to efficiently discover
unresolved any sort of
security flaws while understanding the
mitigation uncounter measures that
are needed to prevent future cyber attacks.
So I performing frequent Network penetration,
testing organizations can determine their
current security posture then after
they Implement, let's see mitigation countermeasures
technique. They can even perform another
penetration testing after to determine
whether their systems actually become
more secure and whether they are
able to fill that gap of lack of security to
put simply
Before we perform any sort of painstreusion testing
such as Network penetration testing. There are
various phases the first phase being pre-engagement.
Then there is information gathering
trapped modeling vulnerability analysis.
The exploitation fees pulse
exploitation fees. And of course
the report writing fees,
during the pre-engagement is
the following needs to be performed by
the provider the provider being the person
or the organization who is going
to perform the network penetration testing for the client.
First and foremost during the
pre-engagement fees is really important that the legal
permission is obtained from the right authorities
before performing any sort
of patient testing activities to put
simply penetration testing uses almost or
the same techniques used
by hackers to actually compromise systems.
So to be on the safe side, it's
really important that a service provider and all
the penetration test of teen legal written
permission from the right authorities before
even performing any sort of penetration testing
ethical Hawking or even any sort of
scanning on the customers Network.
Furthermore it's important to Define The
Rules of Engagement. This is a scoop the
scope will determine or the scoopal outline
the timeline for performing the
security testing when the test can actually
happen. What devices what systems what
IPS or even what networks can
be tested what type of data can
be collected are there any sort of
security concerns? Are there any third party concerns
and most importantly if anything
should go wrong who should a painter
you should test a contact such as let's say the IT
professional or perhaps the it coordinator within
a client's organization.
So the Rules of Engagement or the scoop
is extremely important another important
documentation The Source provided needs to
have is a non-disclosure agreement
for the client this non-disclosure agreement
or the ND is simply an
official contractual agreement between the
customer honestly is provide on
penetration test. So that says any soda sensitive
confidential data that was found during the painteration
tests on the customers in that week. The paint
Trish interest provider will not disclose it
to any parties. So in other words, the customer
might be we can on some important technology that
is being new on the market
and this is intellectual property or perhaps there
is some Financial records that were
discovered.
It's really important that you build a trust with the
customer and to do so in non-disclosure agreement
can help you with this.
The information gathering fees. It's really
common amongst thread actors ethical
attackers penetration testers are even
security researchers to put simply this phase
is used to passively collect information about
the targets organization and their
Network infrastructure.
So what passive information gathering this
is where the penetration tester will actually switch
through any sort of public records that
are available on the internet about the
target. For instance. If you if you
are a network penetration tester and you're given
a particular organization, then you will need to collect a
lot of data about organization to create a some
type of portfolio. Where would you search
for this information? Typically penetration classes
will switch through social media platforms such as
LinkedIn for any employees who may have
a week and that organization and let's
say you find an employee who works within your target organization. You
can check through the employees LinkedIn profile and
see what projects this person has worked
on while this person was employed within the
targets organization.
Sometime employees may post a LinkedIn
articles or include projects and
specify internal technologies
that could actually give you an idea on what
type of devices and systems are
running within their well within the
targets internal Network. You can also check job boosting
websites. Typically when the human resource department
or a recruiter is posting an IT
job related vacancy. Sometimes they may
post their internal Technologies specifying. Hey
a potential candidates should
understand. Let's say particular operating system.
What about web applications? So all
of this details could actually help you as a network
penetration tester to determine what type
of Technology systems devices and let's
say the skill sets
that are needed for their internal ID employees.
This information helps to build a
portfolio.
without even
compromising the organization you could simply search
online again on social
media platforms job posting websites even
online forums uneven the
Target's website for any sort of information that
reveals sensitive details
about internal and the external
network infrastructure.
Another simple example is this imagine that
you're going through a job boosting website and you
saw that the company Pool City
vacancy for an IT professional and some
of the requirements are let's see Windows Server a particular
year or particular release water ball.
Let's say Deepu said
you need to know Lenox servers. What about some Cloud Technologies? Let's
say Azure AWS or even
another cloud provider. This gives you much more
details about hey, this organization is
storing data or storing the
editor in a particular clothes provider environment.
Plus they're using specific Technologies within
the internal Network. So overall
from our paintration Tessa perspective.
You already have some
knowledge about it, you know
next week components their devices and of
course overall the it infrastructure.
Furthermore Patrician testers uses all
of this collected into Mission as mentioned to
create a profile about the Target that also help
you as a penetration testing later
phases of penetration testing. For example,
if you have a solid portfolio or
you able to create a solid portfolio about
the target organization, then you can
further develop exploits to take advantage
of known security weaknesses within devices
that are hosted or devices that
are running on the internal Network.
Another fees is Shrek modeling with shred
modeling. It helps Security Professionals such as
penetration testers aren't even security researchers
to determine how tread actors are
able to compromise various security vulnerabilities on
systems and networks within many
large companies track modeling provides
insights on how organizations commonly
defend or become a
Defender against common threats.
Hence, it is better to understand the account
measures as a penetration tester.
For example, if you're going to break
into a system, ethically or legally and
let's say you try a particular exploit but
exploit doesn't work. Well, perhaps the company
or the target has some type of car countermeasures
or even a mitigation implemented. It
might be a security control or perhaps
it might be a threat prevention
solution.
However, if you use sharp modeling accurately, you
could determine how companies are secure
in their networks plus you can determine what
are some of the most common and popular techniques used
by real hackers out in
industry.
Lastly penetration testers use a
strat modeling to understand types of security controls and
how these security controls can
simply be bypassed use and
threat emulation techniques, of course from a
network penetration tester perspectives. You must
do this, ethically on legally, hence.
It's really really important that you obtain legal
permission before even doing
any sort of security testing or assessment
on a client's Network.
Next is the vulnerability assessment fees
or the vulnerability analysis fees
with vulnerable the analysis
it simply focuses on discovering security flaws
or weaknesses on systems which are
within the school of the network
penetration test. So therefore it's really important
that you stay within scoop. Do not go
outside of your scoop or else you may be
facing some legal trouble.
For each vulnerability phone the network
penetration tester has to determine the
vulnerability severity reading and how this
security flow can be compromised plus how
it can be mitigated.
This phase helps Network penetration tester to
determine the security vulnerabilities which
are easy to exploit and even gain
access to systems because when you're performing in
a penetration test to put simply
it's always easier to go for the low hanging
fruits. The low-hanging fruits
are the security flaws which are easy to compromise. I'll
gain access to a system.
Furthermore vulnerability analysis and evils
the network penetration tester to provide
a detailed report to the client or
the customer outlining the security weaknesses that
were found on the solutions
on how these security flaws could
be resolved.
Then this exploitation fees after performing
a vulnerable the analysis on
the network. The network penetration tester will
need to create or acquire exploits
that can take advantage of the security vulnerable
ties out of found on systems are networks
within the school of the pantry shuntest.
The penetration tester can use various tools
such as Metasploit, which is simply an
exploit development framework to boot create
and launch exploits to Target systems within
the scope.
The penetration tester can also acquire exploits from
various online sources. However, if you
are acquiring exploits from online sources,
you may need to further modify
these exploits and test them
properly before you launch it against the target system.
After exploiting a system, what does traductors do
well, they suppose exploitation fees after
compromising system penetration testers.
Usually Implement persistence on
the victim's system or the compromis system
by implementing persistence. It simply
ensures the penetration tester can remotely access
these compromise devices whenever they
are online during the pantry and that's
Think about every time you want to access
a system. You will need to launch and exploit over and
over again. What if you compromise the system and
you implement multiple back to access, hence, we
want to implement persistence. So therefore during
the timeline for penetration test, we
can simply remotely access the systems as
long as these systems are online.
This technique is also commonly been used
by try doctors.
Penetration testers however, uses similar techniques
to simulate real experiences to test
the client's security controls and
their Trad detection systems. Plus it
provides a good experience to determine
whether the client security team was able
to detect the penetration tester while the
real simulation is taking place.
And last but not least there is a
report writing these.
After any sort of technical security testing
the network penetration tester has to compile
in other words create a technical and an
executive report to the client the
technical report will contain all the technical details
about the security vulnerabilities that
were found and how they were found
what tools we use what techniques we use. They even
find these security weaknesses plus the technical
report will also contain
What type of exploit and how they
exploiters use and the steps use to even
truly determine whether these are security weaknesses or
not?
The executive report is a high level report of
the penetration tests. And that's actually designed
for the executive staff members who are
less concerned about technical details, but more focuses
on overall risk management of
the assets within the companies.
During this video you have learned an understanding
importance of network penetration testing and
how it helps organizations to improve their security
posture. Furthermore. You have discovered the
various phases of penetration testing.
In the next video, you will learn about a different
types of network penetration testing. I hope
this video has been informative for you and thank you
for viewing.