RE: Bank pen test



Hi

First:
If they want a pen test of only 20 servers there is no way to know if the
servers that you haven't tested have the same vulnerabilities unless the 20
are a sample of one of each system down to the os version patch level,
application version patch level etc.

Second:
Core Impact is in my opinion a good tool, but be aware of your selected
exploits. Do you really want to risk running buffer overflow etc. I would
always run a least 2 tools if possible.

Third:
Running a tool is just one step in diligent pen test. You may also do some
manual checking and poking around to verify what the tool has reported.

Last and very important:
Make sure you are specific in your test plan and have the company sign off.
CYA is extremely important.

Hope this is helpful,

Sharon



-----Original Message-----
From: Noe Espinoza Mancillas [mailto:nespinoza@xxxxxxxxxxxxxxx]
Sent: Thursday, March 02, 2006 5:57 PM
To: pen-test@xxxxxxxxxxxxxxxxx
Cc: nespinoza@xxxxxxxxxxxxxxx
Subject: Bank pen test

hello all!

now i'm still wait to start an internal penetration test in a bank .. they
have a lot of servers.. HP Ux, Win, Sun, Linux , etc. and now they are
using ISS (scanner) to find vulnerabilitys and then they make a remedation
with some scripts and other comercial tools... so..
now they need help becouse the ISS scanner every time that are running found
the same vulnerabilitys after patchs the servers. I told them that is really
importan to use some other diferents scanners and make an penetration test
to review if the vulnerabilities are really risk for the bussines!!.. and
they don`t accept it ..

buy they need it.. need to make a remediation of all the vulnerabilities in
all the 4000 servers!

so.. they ask for a pent test for only 20 servers.. and i don`t know how can
i select the number of servers that i need to test to be sure that all the
rest of the servers have the same vulnerabilitis!!.. ?

and what kind of tools can i use to make that!?

i never been in that kind of penetration test :(..

i think to use Core Ipact!

any sugestions?


regards

noe



----------------------------------------------------------------------------
--
This List Sponsored by: Lancope

"Discover the Security Benefits of Cisco NetFlow"
Learn how Cisco NetFlow enables cost-effective security across distributed
enterprise networks. StealthWatch, the veteran Network Behavior Analysis
(NBA)
and Response solution, leverages Cisco NetFlow to provide scalable,
internal network security.
Download FREE Whitepaper "Role of Network Behavior Analysis (NBA) and
Response
Systems in the Enterprise."

http://www.lancope.com/resource/
----------------------------------------------------------------------------
--




------------------------------------------------------------------------------
This List Sponsored by: Lancope

"Discover the Security Benefits of Cisco NetFlow"
Learn how Cisco NetFlow enables cost-effective security across distributed
enterprise networks. StealthWatch, the veteran Network Behavior Analysis (NBA)
and Response solution, leverages Cisco NetFlow to provide scalable,
internal network security.
Download FREE Whitepaper "Role of Network Behavior Analysis (NBA) and Response
Systems in the Enterprise."

http://www.lancope.com/resource/
------------------------------------------------------------------------------



Relevant Pages

  • Re: Bank pen test
    ... If they want a pen test of only 20 servers there is no way to know if the ... "Discover the Security Benefits of Cisco NetFlow" ... the veteran Network Behavior Analysis ...
    (Pen-Test)
  • Re: password cracker for PCAnywhere and VNC (RFB 003.008)
    ... I'm doing a Penetration Test for two servers. ... "Discover the Security Benefits of Cisco NetFlow" ... Download FREE Whitepaper "Role of Network Behavior Analysis and Response ...
    (Pen-Test)
  • RE: Bank pen test
    ... Seeing as how the most important servers can be cracked, ... "Discover the Security Benefits of Cisco NetFlow" ... the veteran Network Behavior Analysis ...
    (Pen-Test)
  • Re: password cracker for PCAnywhere and VNC (RFB 003.008)
    ... I'm doing a Penetration Test for two servers. ... "Discover the Security Benefits of Cisco NetFlow" ... Download FREE Whitepaper "Role of Network Behavior Analysis and Response ...
    (Pen-Test)
  • RE: Bank pen test
    ... The bank will be working to Risk. ... A vulnerability on an internal system is not always a large risk. ... If they want a pen test of only 20 servers there is no way to know if the ... the veteran Network Behavior Analysis ...
    (Pen-Test)