Penetration Testing Assessment Planning

Module 2: Planning and Scoping a Penetration Testing Assessment

• This module covers planning and scoping a penetration testing assessment.
• The module objective is to create penetration testing preliminary documents.

Module Objectives

• Module Title: Planning and Scoping a Penetration Testing Assessment
• Module Objective: Create penetration testing preliminary documents.

Topic Title

• Comparing and Contrasting Governance, Risk, and Compliance Concepts
• Explain the Importance of Scoping and Organizational or Customer Requirements
• Demonstrating an Ethical Hacking Mindset by Maintaining Professionalism and Integrity

Topic Objective

• Explain how governance, risk, compliance, and environmental factors play a role in planning penetration testing.
• Create a penetration test scope and plan document that addresses organizational needs for penetration testing services.
• Establish a personal code of conduct to ensure ethical, professional, and maintain integrity in penetration testing practices.

2.1 Comparing and Contrasting Governance, Risk, and Compliance Concepts

• Overview

  • The planning and preparation phase is vital in penetration testing.

  • Incorrect scoping can lead to client issues, legal problems, and conflicts with internal teams.

  • Note: Red teams are cybersecurity experts hired to simulate a real threat, while blue teams defend the organization from cyber threats.

  • Key concepts to address during the planning and preparation phase include:

    • Target audience
    • Rules of engagement
    • Communication path and channels
    • Available resources
    • Budget
    • Specific disclaimers
    • Technical constraints
    • Resources available to the penetration tester

• Regulatory compliance considerations:

  • PCI DSS (Payment Card Industry Data Security Standard): Focuses on securing credit card payment processing.

  • HIPAA (Health Insurance Portability and Accountability Act): Focuses on simplifying and standardizing healthcare administrative processes, shifting towards electronic records.

  • FedRAMP (Federal Risk and Authorization Management Program): Enables the use of cloud service offerings by the U.S. Federal government.

  • Other considerations are the use of third-party firms for regulatory compliance, penetration testing standards, and privacy-related regulations (e.g., GDPR).

• Regulations in the financial sector

  • Financial institutions safeguard customer information, maintain trust with the community, protect privacy and consumers against fraud and identity theft.
  • Examples of applicable regulations include GLBA, FFIEC, FDIC safeguards act, and NY DFS Cybersecurity Regulation.

• Examples of regulations applicable to the financial sector

  • Title V, Section 501(b) of the Gramm-Leach-Bliley Act (GLBA)
  • Federal Financial Institutions Examination Council (FFIEC) regulations
  • Federal Deposit Insurance Corporation (FDIC) Safeguards Act and Financial Institutions Letters (FILs)
  • NY Department of Financial Services Cybersecurity Regulation (NYCRR Part 500)

• Regulatory compliance considerations (cont.):

  • GLBA defines financial institutions to include many companies not traditionally considered as financial institutions (check cashing, payday lenders, mortgage brokers and educational institutions providing loans to clients).
  • The Federal Trade Commission (FTC) is responsible for enforcing GLBA for financial firms not covered by other regulatory agencies.
  • NY DFS Cybersecurity Regulation requires security penetration testing and assessments.

• Regulations in the healthcare sector

  • Security Standards for the Protection of Electronic Protected Health Information (HIPAA Security Rule)
  • 2009 Health Information Technology for Economic and Clinical Health Act (HITECH Act)
  • 2013 modifications to the HIPAA rules (Omnibus Rule)

• Healthcare

  • Providers (doctors, clinics, hospitals)
  • Plans (insurance companies, HMOs)
  • Clearinghouses (process health information)
  • Business associates (entities performing actions on behalf of covered entities)

• Payment Card Industry Data Security Standard (PCI DSS)

  • Developed to protect cardholders' information, minimize payment losses.
  • Requires adoption by any organization that processes, transmits, or stores payment card data.

• Key Terms Defined by PCI DSS

  • Acquirer
  • Approved scanning vendor (ASV)
  • Merchant
  • Primary account number (PAN)
  • Payment brand
  • PCI forensic investigator (PFI)

• Key Terms Defined by PCI DSS (Continued)

  • Qualified Security Assessor (QSA): trained and certified to perform PCI DSS assessments.
  • Service Provider: A business that handles cardholder data processing, storage, or transmission.

• Cardholder Data and Sensitive Authentication Data

  • Includes PAN, cardholder name, expiration date, service code.
  • Sensitive authentication aspects include full mag stripe data/ equivalent chip data, and CAV2/ CVC2/CVV2/CID and PINs/PIB blocks.
  • The Luhn algorithm is used for identification number validation.

• Typical elements on the front of a credit card:

  • Embedded microchip
  • PAN -Expiration Date -Cardholder Name

• Typical elements on the back of a credit card:

  • Magnetic stripe
  • Security codes (CAV2/CID/ CVC2/CVV2): required for authentication and transaction processing.

2.2 Explaining the Importance of Scoping and Organizational or Customer Requirements

• Overview

  • Module 1 introduced ethical hacking, different standards (PTES, OSSTMM, ISSAF), and methods (NIST, OWASP) for penetration testing.

• Rules of Engagement

  • Specifies conditions for the penetration test.
  • This document should be agreed upon by both parties (client and penetration tester).
  • Examples: Timeline(time frame), testing location, preferred method of communication(schedule of reporting), testing time window, and types of permitted/restricted tests

• Target list and in-scope assets

  • Establishing a comprehensive list of systems, applications, and networks targeted for testing.
  • This encompasses rules, requirements, limitations, APIs (application programming interfaces), wireless networks(SSID).
  • Understand different types of API documentation (SOAP, Swagger, WSDL)
  • Identify different types of API documents.

• Validating the Scope of Engagement

  • Proper communication with clients and stakeholders is essential.
  • Includes confirming and documenting details to ensure clarity, avoiding misunderstanding.
  • Proper documentation of stakeholders' contact and communication protocol (including timing of interactions for reports, emergencies, etc.) is key.
  • Potential clients may ask about cost justification, need for testing, success factors or ROI

• Additional support resources:

  • Software development kits (SDKs)
  • Source code access
  • Application requests and diagrams

• Scope creep

  • Uncontrolled growth of scope leading to expanded cost and time resources.

• Local Restrictions

  • Addressing legal constraints based on specific locations.

2.3 Demonstrating an Ethical Hacking Mindset by Maintaining Professionalism and Integrity

• Background checks for testing teams
• Identifying criminal activity and immediate reporting
• Adherence to the specific scope of engagement

2.4 Planning and Scoping a Penetration Testing Assessment Summary

• This section summarizes the key learnings from the module regarding planning, scoping, and conducting penetration tests for regulatory compliance, specific to the financial and healthcare sectors.

Considerations

• Regulations (GLBA, FFIEC, PCI DSS, HIPAA, etc.)

• Legal aspects (agreements—SLAs, SOWs, MSAs, NDAs)

• Technical considerations (data isolation, password management, key management)

• Scope creep (uncontrolled growth of the penetration testing project)

• Local constraints (legal and operational limitations)

This quiz evaluates your understanding of planning and scoping for a penetration testing assessment. You will learn about the key concepts, including governance, risk, and compliance, and how they impact the creation of preliminary documents for penetration testing services. Test your knowledge on ethical considerations and organizational requirements.