Public enemy number one - the "nessus cut n paster"
Its all good to use nessus or OpenVAS as it helps shorten the process of grabbing banners with nmap and using google/secunia/mitre to find out publicly reported vulnerabilities about the network services in use (which we pretty much end up doing anyway!). We all use nessus as part of our suite of tools but you shouldn't just use nessus! And you definitely shouldn't just append the raw scan results as an appendix with a covering letter! Your client deserves you:
- confirm that the reported vulnerabilites actually provide a risk (i.e. are the vulnerable modules on that webserver actually in use or is this a false positive)
- provide some interpretation and an indication of how easy this vulnerability is to exploit based on your knowledge and experience (i.e. how likely is it that the client be attacked by an SSL MITM attack) and any compensating controls that are in place
- provide pragmatic recommendation on how to address the issue (i.e. a link to technet article etc.)
The "nessus cut n paster" leaves you feeling conned and frustrated as you paid too much for an assessment you could have performed yourself. You have to investigate each of the issues to identify if you should bother fixing them and find out how to address them.
Public enemy number two - the "over caffeinated try hard hacker"
This guy is someone who has just read "Hacking Exposed" and instead of building himself some vmware virtual machines and trying out what he is learning on them, he wants to "play hacker" on your network. On an external network he will focus on "cool and neat" vulnerabilities and forget to report "boring" vulnerabilities (the ones you are likely to get pwned by). On an internal network instead of focusing on testing key controls that secure critical applications (e.g. database listener passwords) he will do crazy stuff like pwning workstations with metasploit and looking for pirated games/music/pron to take home.
The "over caffeinated try hard hacker" leaves you bemused wondering what the hell happened, rebooting boxes and apologising to executives whose email accounts have been ransacked.
Public enemy number three - the "talky talky consultant"
This Svengali like consultant mesmerises you with talk about risks, approaches, ISO standards and buzzwords however never gets down to the discussions you want to have like:
- what are my critical business processes and what applications, infrastructure and information assets are associated?
- what are my key controls?
- how do I test them and record the results and supporting evidence?
- what should be in my security plan to improve my key controls?
- how do I tweak my policy to address new risks?
The talky talky consultant often leaves you stuffed and slightly boozed after a long lunch wondering what value they actually added to your organisation and trying to find a deliverable to justify to your management why you engaged this clown in the first place.
Tips to Countering the fallout:
- Make sure your security consultant has scoped the required work well and documented the scope in a contract or engagement letter in enough detail. It should be clear that work outside the agreed scope is not to be undertaken without express permission (i.e. running exploits, scanning other systems apart from the defined target systems)
- Make sure if an assessment is being provided that the criteria for the assessment is detailed in the engagement letter and provided in the report
- The contract or engagement letter should also describe the required deliverables for each phase of work in detail and the requested structure and content of the report
- Ask for a sample report, mark it up and return it if it doesn't meet your needs.
- Ask for regular updates on activities and require that they be provided so you can keep tabs on what is going on.
{ Comments on this entry are closed }
First and foremost, I'm
thankful for The Boss. Yes, she is still my boss and no one provides
more support for what I do than my wife. She was the first one to
suggest that I really needed to get back to Incite and that it's the
thing that makes me happiest. She's ridden shotgun through the highs
and lows and back again. And hardly puked on my shoes through the
turbulence.
