July 14, 2020
With the FBI reporting a fourfold increase in cybercrime as hackers rush to take advantage of remote workers and the uncertainty brought by COVID, companies need to be more vigilant than ever on their potential cyber vulnerabilities. In this blog, we’ll walk you through the basics on pen testing, and explain what role it should be playing in your current cybersecurity strategy to protect your remote workers.
What are Pen Tests?
Penetration tests, or “pen tests”, are controlled cyberattacks that illustrate how secure a network or system is. They are often performed annually and are used by cybersecurity specialists to both determine if there are vulnerabilities in a given network as well as provide solutions or advice on further risk mitigation. Pen tests are an example of white hat hacking, as opposed to malicious black hat hacking which tries to exploit vulnerabilities without prior permission. Pen tests can be invaluable to companies that seek to discover how vulnerable their networks could be in the event of an attempted breach.
How do Pen Tests Work?
A pen test generally follows five phases:1. Reconnaissance
2. Scanning (enumeration)
3. Gaining access (exploitation)
4. Maintaining access
5. Covering tracks
Pen tests typically start in a reconnaissance phase, which is where the white hat hackers gather information on the target system in order to prepare for their main attack. Service enumeration involves actively connecting to the target network and scanning for open and exploitable ports. By discovering open ports in the target system, hackers can also learn the version information of software used by the target system, and subsequently try to search for ways to breach that specific version of the software.
Once enough information has been gathered, the penetration test can move onto gaining and maintaining access to the target network. There are numerous techniques used by pen testers in both of these phases; for example, they could rely on Man-in-the-Middle attacks to disrupt problematic communications which might expose their breach. The most effective pen testers will simulate crafty hackers by adapting to the situation and adopting new tactics to most efficiently breach the target system. During these phases, a “payload” (simulated malicious software) is delivered and used to identify the kind of valuable data that could be extracted from the targeted network. After gathering enough data, the hackers must lastly focus on covering their tracks and remove any traces of their breach.
How successful are pen tests normally?
Unfortunately, more successful than you’d imagine. A 2018 report by Positive Technologies revealed several alarming insights regarding pen testing. Of 33 projects sampled, 92% of pen tests successfully gained LAN access, and half of those companies had their network perimeters breached in only one step. One notable case only required social engineering to breach the network. Web applications were three times more likely to serve as access vectors – pathways used by hackers to breach systems – than other systems combined. Web applications are especially prone to becoming vectors because their continuous development often leads to coding errors that can be exploited by hackers. The study also determined that of the vulnerabilities found, 88% of them were “critical” in severity, or vulnerabilities that must be addressed immediately. Since the sampled companies belonged to a wide variety of industries, it’s safe to say that many companies are more vulnerable to cyberattacks than they realize.Do I need a pen test?
Though only some companies are required to have annual pen tests in compliance with industrial regulations, pen testing should be one of the first services considered for any company who wants to improve their cybersecurity. At a minimum the first two phases of pen testing, i.e. reconnaissance and scanning should be conducted. These first two phases are sometimes described as vulnerability testing or a vulnerability assessment (not to be confused with a vulnerability scan). If you were to think of your network like a house, vulnerability testing would find all the doors and windows and see if anything is unlocked or unprotected, without actually trying to pick locks or trying to force the windows open (like in a pen test). Both pen tests and vulnerability tests will verify how secure the system is in risk-free simulations and expose any exploitable openings. In short, they are the best way of understanding what’s at stake in the event of a real cyberattack.What about remote workers?
With COVID forcing teams to move to remote work and cybercriminals taking advantage of the confusion, IT departments are struggling to assess the changing threat landscape for their business, rendering vulnerability tests and pen tests all the more essential. Since the start of the pandemic, a survey found that nearly half of US office workers lacked any remote experience, 75% of them relied entirely on their IT team for cybersecurity advice, and 20% claimed their team had not offered any tips on how to safely adjust to remote work. Even if you already have conducted pen tests and vulnerability tests, you should reevaluate your strategy in the face of remote work to account for the added risks brought by home networks.Vulnerability tests and pen tests are critical for home networks because these targets are generally less protected than corporate networks and a homeowner is less likely to know about possible vulnerabilities in their network. For example, an Internet of Things (IoT) device could be opening a port via Universal Plug-and-Play, a set of networking protocols that enables devices on the same network to communicate with each other. When people set up an IoT device, they often don’t realize that they are opening a port in their network that hackers can exploit to gain access to their home network and potentially their confidential data or even their corporate VPN. Regular pen tests or vulnerability tests can greatly assist in reducing the risks associated with remote work by providing visibility both to employees and ultimately the IT department on the vulnerabilities brought by each employee network, along with recommendations on how to mitigate them.
While it’s essential and fairly easy to have a thorough pen test for your corporate network, it’s a lot more difficult to conduct one for all your employee’s home networks. At a minimum however, it’s a good idea to perform a vulnerability test in order to gain the best understanding of what your technical risks may be. It’s important to note that penetration testing should not be treated as a complete solution. To effectively address cyberthreats, it needs to play a part of a larger cybersecurity plan, including effective awareness training for employees, a strong and thorough set of policies and best practices, and a good antivirus software and firewall. In the face of your remote work transition, all of these practices should be reevaluated and adjusted accordingly.
Protect your remote workers
Through Guardian Angel, Intellectmap’s cybersecurity service designed for remote workers, you can gain a full understanding of the weak links in your company and how to address them. In addition to conducting tests for your corporate network, Intellectmap’s team of penetration testers perform vulnerability testing of your employees' remote networks and provide recommendations to ensure they aren't compromising your security. On top of penetration tests and vulnerability tests, Intellectmap's Guardian Angel solution also addresses other common cybersecurity risks brought by remote workers, and Intellectmap’s team of consultants will work with your company to build cybersecurity resiliency in the face of both technical and human threats.To learn more about how Guardian Angel can protect your remote workers, schedule a free call with a cybersecurity consultant.
By: Jake Sorensen