While it is theoretically possible to say that the testing strategy should follow a "no-holds-barred" approach, practically this is not usually the case. This approach is encouraged so that the ethical hacker is given the chance to gain maximum access.
The next aspect is how to conduct the evaluation. There are several methods for carrying out ethical hacking, but the two most used approaches are the limited vulnerability analysis and attack and penetration testing. Limited vulnerability analysis deals with enumerating the specific entry points to the organization's information systems over the Internet, as well as the visibility of mission critical systems and data from a connection on the internal network. On detection, the potential entry points and mission critical systems are scanned for known vulnerabilities. The scanning is done using standard connection techniques and not solely based on vulnerability scanners.
In an attack and penetration testing, discovery scans are conducted to gain as much information as possible about the target environment. Similar to the limited vulnerability analysis, the penetration scans can be performed from both the Internet and internal network perspective. This approach differs from a limited vulnerability analysis in that here, the testing is not limited to scanning alone. It goes a step further and tries to exploit the vulnerabilities. This is said to simulate a real threat to data security.
Clients usually prefer a limited vulnerability analysis because they don't want to risk loss of data or any other damage.
It should be communicated to the organization that there are inherent risks in undertaking an ethical hack. These can include alarmed staff and unintentional system crashes, degraded network or system performance, denial of service, and log-file size explosions. A possible way of minimizing this risk is to conduct the tests after working hours or holidays. The organization should also provide contacts within, who can respond to calls from the ethical hackers if a system or network appears to have been adversely affected by the evaluation or if an extremely dangerous vulnerability is found that should be immediately corrected. While conducting an evaluation, ethical hackers may come across security holes that cannot be fixed within the pre determined timeframe.
Therefore, the ethical hacker must communicate to his client the urgency for corrective action that can extend even after the evaluation is completed. If the system administrator delays the evaluation of his system until a few days or weeks before his computers need to go online again, no ethical hacker can provide a really complete evaluation or implement the corrections for potentially immense security problems. Therefore, such aspects must be considered during the preparation phase.
The last phase is the conclusion phase, where the results of the evaluation are communicated explicitly in a report and the organization appraised of the security threats, vulnerabilities and recommendations for protection.
COMMENTS