Re: External Pentests Obsolete?

["rajat swarup" <rajats () gmail com>]

On 8/9/07, Yiannis Koukouras <d4rw1n () linuxmail org> wrote:
> Do you think that an external infrastructure pentest is nowadays obsolete?
>
> What I want to say is that, most of the serious companies nowadays will only have a few >servers on their DMZ (web 
> server, mail server, SSL concentrator, terminal server, citrix) >and will only allow access to one or two ports for 
> each of them. The rest of the >infrastructure (excluding the internet facing router and firewall) will be completely 
> > inaccessible.
>
> Thus, if web application testing is out of scope, there isn't much to test, is it? Only half a dozen of services to 
> check vulnerabilities and misconfiguration, check if mail rely is on, make a password bruteforce attack(?), check 
> that the DNS can't be poison and VOILA! You have finished!
>
> Do you think that it is ethical to consult our clients to "buy" an external pentest anymore?
>
>
> --
> Ioannis Koukouras

Hi Loannis,

External pen-tests are definitely not obsolete.  In fact, I'd say they
are more critical than internal pen-test.
> From a technical standpoint, so what if the firewall could be in
place, at least some services would be exposed. every exposed service
is an attack candidate due to the vulnerabilities discovered in the
applications (FTPd, HTTP, ), there could be ineffective inbound rules
at the firewall...how do u uncover them without testing? Moreover,
there could be IP address spaces owned by organization that may not be
the most used ones (or monitored).  Such "forgotten" IP address spaces
can be found effectively by pen test.

> From a managerial standpoint, an effective security policy is one that
secure, monitor, test, improve, secure, monitor.....
So without testing, you are breaking a cycle of hardening security.
If an organization thinks that it's current security posture is going
to suffice for future as well, then they need a new information
security team.

HTH,
-- 
Rajat Swarup

http://rajatswarup.blogspot.com/

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------