Chapter 5: Monitoring, Scanning, and Penetration Testing

One of the most important roles of a security professional is to keep the company's environment safe from attack and so, in this chapter, we are going to look at monitoring, scanning, and penetration testing.

In this chapter, we will cover the following topics:

• Penetration Testing Concepts
• Passive and Active Reconnaissance
• Exercise Types
• Vulnerability Scanning Concepts
• Syslog/Security Information and Event Management
• Threat Hunting

Penetration Testing Concepts

A penetration test is an intrusive test where a third party has been authorized to attack a company's network to identify weaknesses. The intrusive tests used by them can cause damage to your systems.

Penetration testing is commonly known as pen-testing. Pen testers are given different amounts of information, including the following:

• Black Box: Black box pen testers work in an unknown environment and are given no information on the company. They will carry out initial exploitation looking for vulnerabilities.
• Gray Box: Gray box pen testers work in a partially known environment as they are given limited internal information.
• White Box: White box pen testers work in a known environment. One of the purposes of a white box pen tester is to test applications in a sandbox so that when they are released, they do not have any vulnerabilities. They know everything about a system or application as they have access to an application&apos...

Passive and Active Reconnaissance

In the CompTIA Security+ exam, they measure the types of reconnaissance that could be used by an attacker. Let's first look at active and passive reconnaissance and then the tools that can be used to carry out these activities:

• Active Reconnaissance: Active reconnaissance is where someone actively tries to gain information about the system. For example, an attacker finds a username left on one of the corporate desktops; they then ring up the Active Directory team, pretending to be that person, and requests a password reset. This is active reconnaissance, as they have carried out an action.
• Passive Reconnaissance: Passive reconnaissance is where an attacker is constantly gathering information, without the victim's knowledge. For example, an attacker is sitting in a coffee shop when they realize that two members of Company A's security team are having lunch. The attacker listens to every word that is said, and the security...

Exercise Types

Team exercises are similar to pen testing, but they use friendly IT professionals to participate in the different teams. The teams are red, blue, green, white, and purple. Let's look at each of these in turn:

Figure 5.1 – Exercise teams

Here is a brief overview of the different teams:

• Red Team: The red team mimics an attacker, and they try to find vulnerabilities within your company. They quite often use social engineering and phishing as part of their attacks.
• Blue Team: The blue team looks to discover security vulnerabilities within the company and take action to mitigate them so that the company is secure.
• White Team: The white team organizes and adjudicates cybersecurity exercises based on the information given. They set the rules of engagement and details of the exercise. If they find that the red team has created a serious vulnerability, they will stop the exercise immediately. They score the blue team&apos...

Vulnerability Scanning Concepts

A vulnerability scanner is a passive scanner that identifies vulnerabilities or weaknesses in a system. For example, there could be a missing update for the operating system, anti-virus solutions, or account vulnerabilities.

A Zero-Day exploit cannot be traced by a vulnerability scanner; the exploit has not yet been identified and has no updates or patches available. Let's look at the type of output a vulnerability scanner could produce:

• Common Vulnerabilities and Exposure (CVE): Massachusetts Institute of Technology Research & Engineering (MITRE) is a non-profit, government-funded organization working out of Bedford Massachusetts that looks at different attack vectors. They produced the Common Vulnerability and Exposure (CVE) list, which looks at computer flaws and can identify the platforms affected. Each flaw has an ID. Please look at the following URL for more information: https://www.cvedetails.com/.
• Common Vulnerabilities...

Syslog/Security Information and Event Management

The systems on a network produce a massive amount of information in log files and most of them will be related to errors or possible attacks. They will require a real-time solution to correlate these events so that the security team can be alerted immediately. Let's look at the role that the SIEM and syslog server play.

Security Information and Event Management (SIEM) is regarded as an IT best practice, used by regulated industries to fulfill security and audit compliance regulations, for example, HIPAA, GDPR, SOX, and PCI DSS. SIEM supports IT teams by consolidating event log values through the correlation, aggregation, normalizing standard, and non-standard log formats; it can also filter out false positives.

The only time that a SIEM system will not provide the correct information is when the wrong filters are used or the wrong host is monitored. In these cases, a false positive will be produced.

A System Logging (Syslog...

Security Orchestration, Automation, and Response

SOAR is an automated tool that integrates all of your security processes and tools in a central location. As an automated process that uses machine learning and artificial intelligence that makes it faster than humans searching for evidence of attacks, it helps reduce the mean time to detect (MTTD) and accelerates the time to respond to events. This could release members of the IT team to carry out other tasks.

The SOAR system uses playbooks that define an incident and the action taken. If the SOAR system does not detect an incident in a timely fashion, the playbook would have to be better tuned.

This will produce faster alert information for the security operations team, where the human entities can take further action to keep the company safe. Let's look at the workflow in the following diagram:

Figure 5.3 – Security integration

As you can see in the preceding diagram, we first sort the raw...

Review Questions

Now, it's time to check your knowledge. Answer the questions, and then check your answers, which can be found in the Solutions section at the end of the book:

1. Which pen tester would be given source code?
2. Why would a shared account pose a problem to monitoring?
3. Which pen tester would be given no access before the test but, at the last minute, is given a diagram of the desktops?
4. What needs to be established prior to a pen test commencing?
5. While carrying out an unannounced pen test, how does the tester know if the internal security team is on to him?
6. What is the scope of rules of engagement?
7. If the pen test has been announced to the IT team, what information should they give regarding the test before the test start?
8. What is the main difference between a credentialed and a non-credentialed vulnerability scan?
9. At what phase of a pen test does the tester return the systems to the original state or inform the IT team of vulnerabilities...