Re: honeypot in conjunction with pen test?

From: Daniel Polombo (polombo@cartel-securite.fr)
Date: 06/07/02 

Date: Fri, 07 Jun 2002 19:07:51 +0200
From: Daniel Polombo <polombo@cartel-securite.fr>
To: Mark Tinberg <tinberg@securepipe.com>

Mark Tinberg wrote:

> If I may respectfully disagree, a pen-test *is* about getting in, and is
> distinct from an audit. To me (and this may just be a semantic
> difference) an audit is a completely different animal where the auditors
> spend several weeks/months on-site going over the client's procedures and
> network equipment with a fine toothed comb, as well as interviewing the
> admins. The report will contain things that should be tightened up as
> well as places where the written policy differs from what is implemented
> in the network hardware and where the admins differ from policy. It is
> not something that can be done remotely, although it may involve a
> pen-test for verification.

I tend to separate this into three different categories :

- the pen-test is all about getting in, as Mark said. Indeed, its very
name implies that the main purpose is to find _a_ hole, and not _all_
holes, the point (or one of the points, depending on the particulars)
being that if an experienced team of pen-testers cannot break into the
system, most hackers shouldn't either (note the "most", we all know
there's no such thing as perfect security).

- the vulnerability assessment is similar to the pen-test as far as the
tools and methods are concerned, but aims at identifying _all_
vulnerabilities in a target platform.

- the security audit is the full package, heavily relying on a formal
methodology, including a complete analysis of the client's security
policy and how it is applied, and so on.

But, of course, that's just me, and as far as I know, there's no
precise, widely accepted definition. 

--
Daniel Polombo
Cartel Securite

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • RE: Pen-Test and Social Engineering
    ... may and should be a SE aspect of said Pen-Test. ... I know a place where the security guard barely ... Time of the attacks. ... Audit your website security with Acunetix Web Vulnerability Scanner: ...
    (Pen-Test)
  • RE: syslog
    ... For the same kind of environment, I am using Computer Associates eTrust ... Audit integrated with Security command center for an easy event management ... and consolidation of logs + administration of all the Security ...
    (Security-Basics)
  • RE: Blue Team ROE
    ... These types of constraints are a way to create the illusion of due ... diligence in that they are having an outside company perform a security ... the audit by client constraints. ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: How to determine who changed permissions on a directory?
    ... I used the "Security Monitoring and Attack Detection Planning Guide" from ... Audit Account Logon events - Success, Failure ... Audit Object Access - Success, ...
    (microsoft.public.security)
  • Re: How to determine who changed permissions on a directory?
    ... I used the "Security Monitoring and Attack Detection Planning Guide" from ... Audit Account Logon events - Success, Failure ... Audit Object Access - Success, ...
    (microsoft.public.security)