Cyber Security Articles

Book Review: Social Engineering
The new book from MIT Press, Social Engineering: How Crowdmasters, Phreaks, Hackers, and Trolls Created a New Form of Manipulative
Guest Post: Thoughts on Cybersecurity Bills in the 117th Congress
By Liam Dorney   Reading through the new report Cybersecurity Bills in the 117th Congress from the Cyber Policy Institute,
New Report on Cybersecurity Bills in the 117th Congress
Our sister organization, The Cyber Policy Institute, just published its first, but hopefully not last report on federal legislation that
Book Review: Trust in Computer Systems and the Cloud
Trust in Computer Systems and the Cloud by Mike Bursell, CEO and co-founder of Profian, takes on a subject of
Thought Leader Video: Casey Allen from Concentric on Democratizing Cybersecurity
In this video, Casey Allen, CIO of Concentric, argues that cybersecurity needs to be more accessible to consumers and smaller
Quantifying Cyber Risk
Consider the following common scenario, which is unfolding in executive suites and corporate boardrooms across the world: A Chief Information
Guest Post: Web Pen-test Checklist…What to Check and How
by Ankit Pahuja A web pen-test, also known as a penetration test, is an attempt to find vulnerabilities on your
Mathieu Gorge, CEO of VigiTrust on China’s New Personal Information Protection Law (PIPL)
In this Thought Leaders video from Cyber Policy Institute, our sister organization, Mathieu Gorge, CEO of VigiTrust, discusses the impact of
Thought Leader Video: Tenable’s Jamie Brown discusses public/private partnerships for cybersecurity
Starting in January, 2022, our sister organization, the Cyber Policy Institute began interviewing cyber security thought leaders from industry and
Securing the Building Management Systems (BMS)
I’m old enough to remember when elevators told you what floor they were on using a needle that looked like

Cyber Security Articles

What This Cyber Security Articles Page Is About

The goal of Journal of Cyber Policy is to provide commentary and stimulate conversations about important cyber security topics. Our parallel goal is to discuss cyber issues in plain English, liberating this critical subject from the exclusive realm of specialized engineers and hackers. Throughout, we try to talk about cyber security and related issues from the perspectives of public policy, national security, corporate policy and compliance.

 

Why Articles about Cyber Security Matter

We are living in an era where digital technology dominates so much of our lives. Digital risk naturally accompanies this reality. Smartphones, the IoT, the Internet and so forth make our lives easier, but they also expose us to threats. Some of these threats come from nation state actors. We believe Americans could be better-informed about these risks. And, while there’s certainly no lack of content online about cyberthreats, room still exists for cyber security articles that integrate the subject’s diverse themes of technology, politics and business.

For example, Russian disinformation and Chinese espionage are not new, but today’s digital landscape makes these familiar tactics deadly, in political terms. The Cold War was largely analog in nature, with offensive campaigns quite limited in scope and impact. While Cold War dynamics may survive today, they are having a radically different effect on American society and politics than anything that came before.

It can be tricky to tease out the differences between today and a generation ago. American politics and governance have always been messy, dishonest and idiotic, but there were at least some fact-based controls on it. This is no longer the case. Our enemies are exploiting this new reality. In some cases, they’ve created this new reality.

We see the impacts of these new measures, but leaders across the government and business sectors generally fail to understand the transformative nature of technology, e.g. Amazon is not just a bigger mail order store; the iPhone is not just a phone with fancy features, and so forth. These cognitive gaps lead to deficiencies in the perception of risk. They enable our leaders to underestimate our enemies and how they can win without firing a shot. We also tend to overestimate our defenses and resiliency.

The digitization of society, commerce and politics renders America defenseless in ways that we are only beginning to understand. Digital transformation is double edge. America’s rush to digitize its economy and society produces as much risk as it does benefits. For example, we have to manage the tensions between mobility and surveillance, between big data and privacy and so on.

The Topics We Cover in These Articles

We deal with a wide range of cyber security topics in these articles. Some discuss cyber election interference. Others look at geopolitical cyber risks, such as our recent series on Russian disinformation and “Active Measures.” We will frequently check in on the state of enterprise architecture and cloud computing, seeking expert insights into the best practices and new security technologies that are influencing security policies in these areas of information technology. We cover the gamut of security subjects: malware, phishing, identity and access management (IAM), privileged access management (PAM), zero trust, data security, application security, secure DevOps (DevSecOps), red-blue teaming, automation, Security Orchestration, Automation and Response (SOAR), threat monitoring, incident response, intrusion detection, encrypting, key management and on and on. Our cyber security articles look at compliance, government cybersecurity frames like NIST NSF, GDPR, CCPA and more.

Book Review: Social Engineering

The new book from MIT Press, Social Engineering: How Crowdmasters, Phreaks, Hackers, and Trolls Created a New Form of Manipulative Communication, by Robert W. Gehl and Sean T. Lawson, takes on an important and ambitious topic. At the risk of oversimplification, Gehl and Lawson set out to answer a question that’s been perplexing thinking, observant Americans for the last six years: What on earth is going on with public opinion and the news—and politics?

While not everyone would agree with their perspective, Gehl and Lawson reasonably argue that the country has gone more or less crazy, with tens of millions of people passionately believing in demonstrable falsehoods. As they say in the book, “The United States is awash in a disorienting and sometimes deadly media environment.” People share, and believe, manipulative information about elections and bogus COVID cures on social media.

It’s a good question, and Social Engineering offers an approach to answering it. Gehl and Lawson, who are professors at Louisiana Tech and University of Utah, respectively, break the problem down and offer an analysis of how mass communications have changed over the least few years. Their high-level takeaway is that the dividing line between mass communications, as exemplified by radio and TV, and interpersonal communications like email and chat, has blurred. We are now in an era of what they call “masspersonal” communications.

Masspersonal communications is the practice of sharing a personalized message with a mass audience.

Masspersonal communications is the practice of sharing a personalized message with a mass audience. They cite examples of Facebook memes that are exquisitely tuned to each social media user’s personal psychographic profile. The election manipulation by Cambridge Analytica is a case in point. After extensive data mining on American voters, the firm and its affiliates were able to target millions of people with personalized messages that motivated them to support Donald Trump for president.

As they point out, the general strategy here is not at all new. It is social engineering, the archetypal approach to public relations set out by industry pioneers like Edward Bernays and Doris Fleischman in the 1920s. These original social engineers believed the public relations professions had a right, if not a duty, to mold public opinion with the goal of reengineering society into a better version of itself. In this endeavor, they likened themselves to other heroic engineers of the era, who solved problems of public health and human existence through innovative engineering solutions.

As we all know, however, not all PR professionals have been so noble in the intervening century. The Bernays/ Fleischman techniques have been exploited to obscure the danger of cigarettes, nuclear power and other societal ills.

What’s different now is that technology has made it possible to take the Bernays/ Fleischman strategy of mass persuasion and combine it with data analytics to deliver social engineering at a personalized level. Mass plus personal. Masspersonal.

Today’s social engineers have borrowed sly tactics from hackers, the other group whose members call themselves social engineers.

In this, the authors argue, today’s social engineers have borrowed sly tactics from hackers, the other group whose members call themselves social engineers. The book quotes the notorious hacker Kevin Mitnick extensively. In Mitnick’s view, as the authors relate, it is usually far easier to hack a person than it is to hack a computer system. The social engineers, starting with the original “phone phreaks” of the 1970s, are adept at tricking people into sharing passwords and granting access to restricted networks. The masspersonal social engineers also use these techniques to manipulate large groups of people, not just one victim at a time.

Gehl and Lawson have definitely done their homework here. They offer extensive analysis and examples of the connections between hacking, Mitnick style social engineering and their paradigm of masspersonal social engineering. Much of this is outside of my academic and intellectual weight class, so I don’t feel entirely comfortable assessing the validity of their arguments. I will offer a few observations, however.

At a base level, this book provides an insightful and accurate take on a communications revolution that is reshaping politics and society in general. The revolution is new and still unfolding, so it’s hard to pin down exactly what’s happening—except, what’s happening now is different from what happened before. If nothing else, the book is a wakeup call for people who are struggling to understand the forces shaping public opinion in baffling ways.

The book also answers an implicit question asked by societal and political observers, which is why the old techniques of rebutting opposing points of view in the media no longer work.

The book also answers an implicit question asked by societal and political observers, which is why the old techniques of rebutting opposing points of view in the media no longer work. Why is that when Donald Trump sent out a tweet, tens of millions of people aligned with his point of view, while no amount of guest appearances on Sunday talk shows or New York Times op-eds could do anything to budge his base? The book gives an answer. Masspersonal communications is more powerful and reaches deeper into the public consciousness than traditional mass media.

One area where I think the authors have missed the point, however, is in their eulogies for the Bernays/ Fleischman model of mass communications and social engineering. They say it no longer exists. This may be true in the sense that pompous elitists don’t strut around bragging that they are in control of public opinion. That’s passé. However, their techniques are very much with us.

It’s important not to ignore the raw power of television and radio today in shaping opinions and driving political action. A brief glance at Fox News and its ability to persuade millions of people to think a certain way should blunt any claim that traditional social engineering is dead. Its practitioners are simply lurking in the shadows, rather than claiming a divine right to reshape American society.

Overall, this is an important book, one that contributes much-needed insights into a confusing and alarming time.

To order the book, visit https://amzn.to/36lBhCJ

 

Guest Post: Thoughts on Cybersecurity Bills in the 117th Congress

By Liam Dorney

 

Reading through the new report Cybersecurity Bills in the 117th Congress from the Cyber Policy Institute, I am struck by the range and scope of legislative activity on this issue. The report reviews the 80 cybersecurity-related bills submitted or passed by the 117th Congress between January 2021 and January 2022. With that in mind, here are some specific thoughts on pieces of legislation that caught my attention for better or worse:

  • 1605and H.R. 4350, the National Defense Authorization Act for Fiscal Year 2022—The report says, “All federal agencies will eliminate legacy software, a housekeeping task that will reduce security threats.” This is an immense undertaking for the federal government, requiring a sound implementation of inventory and configuration management. Whether it is a CIS control (Control 1) or a NIST control (CM-02, CM-08, AU-06 (NIST SP800-53 (version) used for critical government support (i.e., FedRAMP), the control is, and has been, considered critical and foundational for some time. When legislation like NDAA passes, right-sizing funding (specifically targeted) and execution efforts (i.e., how to sunset technology to include configuration and hardening of replacements) are crucial to the success of this legislation.

 

  • 1687: Small Business Cyber Training Act of 2021and H.R. 4515: Small Business Development Center Cyber Training Act of 2021—This is a very healthy and welcomed approach to training those on the front lines of small businesses. Many vendors, including SimSpace, are standing by to assist with this kind of training. Socialization of those vendors and their solutions based on known, successful past performance with the government will help increase access for small businesses and, by proxy, improve that state of information security in our country.

 

  • 3522: Ukraine Democracy Defense Lend-Lease Act of 2022/S. 3488: Defending Ukraine Sovereignty Act of 2022 and H.R. 6470: Defending Ukraine—Similar to efforts led by the Departments of State, Defense, and agencies throughout government, partnering with those in the crosshairs of our named and unnamed adversaries is sound statecraft. Monitoring, coordination, and validation of how those technologies and TTPs are utilized, especially against intended targets, remains a crucial area for further consideration. When dealing with cultural (non-state defined) boundaries, many in the US are distant enough from external cultural conflicts (potentially older than our country) that understanding the employment of advantages (technological or otherwise) remains limited and often vague when considering a well-defined “long game” for our country and those who need our support. This is something our nation-state adversaries do inherently, and it’s time for us to as well.

 

  • 2292: Study on Cyber-Attack Response Options Act—Pointing back to CISA, we have so much to get right before opening the flood gates to counter attacks. That said, adding to existing playbooks for the defense of private information systems with proportional responses could make sense. While the private sector has a fairly well-defined standard (and maturing technology set) for red teaming, BAS, and penetration testing, this study should make some strong recommendations for coordination of efforts across critical infrastructure sectors. In the world of offensive security, attribution is extremely complex. One would want to consider the ramifications for incorrect (think US on the US) or inappropriate (#company vs. competitor) attribution for offensive actions taken under this kind of guidance.

 

  • R. 4551: RANSOMWARE Act—Legislation dealing with ransomware should be keenly focused on what to do when in a ransomware situation and strictly avoid treating ransomware as a distinct function of an attack framework. That is to say, providing clear guidance on what to do (i.e., a methodology) and what tools to respond with (opensource and for a fee) when a company or agency detects unauthorized encryption of critical business systems is where this bill goes right. Again, pointing at CISA, we have the tools identified, but we need more employment methodologies that speak to and support business. Where it could go wrong is if this bill wraps compromise (intrusion, breach) and payload delivery into what the media has labeled ransomware, which is, in fact, the execution of that payload restricting access to business systems (in whole or in part). A lot happens before a company gets into a full-blown Ransomware scenario, and we should be clear about that in the RANSOMWARE Act. This bill should also avoid attempting to provide a solution to federally supported on-prem decryption solutions. Privacy advocates (myself included) do not want to see the federal government engaging with the private sector to find ways to break encryption. Instead, provide a practical, cost-considerate way for those hit with ransomware to solve their problem: retrieve their data or restore their systems. In my mind, getting left of the situation by offering legislative incentives for routine, secure system backups makes a whole lot of sense. It’s worth pointing out that secure backup has been part of federal controls for well over a decade. Ransomware should be the impetus for moving everyone to use secure system backups. I’ve repeated “secure system backups” several times intentionally……secure system backups.

 

About the author: Liam Dorney is CEO of Resolvn, a SimSpace subsidiary. Resolvn offers cyber range solutions with offensive and defensive security methodologies.

 

New Report on Cybersecurity Bills in the 117th Congress

Our sister organization, The Cyber Policy Institute, just published its first, but hopefully not last report on federal legislation that deals with cybersecurity. The report, Cybersecurity Bills in the 117th Congress, summarizes the 80 bills submitted or passed by the 117th Congress between January 2021 and January 2022. The bills, several of which were included in the National Defense Authorization Act for Fiscal Year 2022 (NDAA), which was signed into law by President Biden on December 27, 2021, cover a wide range of topics from defense and foreign relations to business, workforce and disaster preparedness.

In terms of breadth and depth, it’s impressive to see how much effort the various members of Congress and committees have put into cybersecurity. There’s a tendency to assume that Congress isn’t doing enough about the country’s cyber vulnerability, but the scope of the legislative agenda says otherwise.

Indeed, the report is already missing one major recent bill, which was passed after the report went to press. the Strengthening American Cybersecurity Act, already dubbed “SACA” by the cyber industrial complex, was spearheaded by leaders of the Homeland Security and Governmental Affairs Committee. The bill was sponsored by Sen. Gary Peters (D-Mich), the committee chairman, and its ranking member, Sen. Rob Portman (R-Ohio). SACA proposed more aggressive incident reporting and proposed to modernize the Federal Information Security Management Act (FISMA).

Of the 80 bills covered in the report, five have been signed into law, 10 have passed one or both houses of Congress, and 32 are still in committees. The bills cover national security and defense, protecting intellectual property, protecting American business, defending critical American infrastructure, developing cybersecurity skills in people both inside and outside the government, protecting children’s welfare and protecting Americans’ privacy.

Prepared by Dr. K.S. Little, a Research Fellow at the Cyber Policy Institute, the report breaks down the massive amount of information in the proposed and passed legislation and explains the relevance and impact of the legislation on each sector.

Industry leaders have been receptive to the report. For example, Tyler Young, Director of Security at Relativity, said, “This report does an excellent job of summarizing the 80 bills that have been submitted or passed by the 117th Congress during the first year of its session and really illuminates the breadth of cybersecurity’s impact across different government departments and committees.”

Marcus Fowler, SVP Strategic Engagements and Threats at Darktrace, remarked, “Given the growing global cyber aggression between and from nation-state and non-nation state actors, policymakers need to accelerate the cyber laws outlined, given the sense of urgency commensurate with the threat, especially with Russia’s actions in Ukraine. These events will spill over, at least in cyber, to the targeting of Western economic stability and will extend beyond any eventual stalemate in the on-the-ground conflict. The priorities should be increasing cyber resourcing of federal, state, tribal, and local institutions, expanding the cyber workforce, and formalizing public-private partnership and reporting procedures.”

Chris Olson, CEO of The Media Trust, shared. “Many of the bills before Congress in 2022 address important cybersecurity issues currently facing consumers, businesses and government organizations at an unprecedented scale. Among these are H.R. 4551 which aims to provide better intelligence on state-sponsored cybersecurity attacks, H.R. 474 which makes strides towards national data privacy legislation, and H.R. 807 which creates new protections for exploited children.”

Olsen added, “Unfortunately, key factors driving cybersecurity risk in the U.S are underrepresented or entirely absent from the bills currently before Congress – particularly digital supply chain vulnerabilities that impact websites and mobile applications. Today, the Web is a borderless entity which lacks protections against the activity of advanced persistent threat (APT) groups and state-sponsored threat actors. This oversight leaves Americans wide open to manipulation and compromise.”

Olsen makes a valid point, one that underscores the difficulty in trying to legislate the country out of its cyber vulnerability. Some issues are structural, such as the “borderless” nature of the Web. Unless laws can deal with that weakness, a great deal of risk exposure remains. In addition, legislation is subject to execution, and as we have seen, this can fall apart despite the best of intentions.

 

To download the report, visit https://cyberpolicyinstitute.org/wp-content/uploads/2022/03/CybersecurityBills-117Congress-final.pdf

 

 

Book Review: Trust in Computer Systems and the Cloud

Trust in Computer Systems and the Cloud by Mike Bursell, CEO and co-founder of Profian, takes on a subject of monumental importance in cybersecurity that most of us tend to overlook it on a daily basis. Trust, functioning as a noun and verb, is the root of almost every control and countermeasure in the world of security. Yet, trust is poorly—or at least incompletely—understood by most security and computing professionals. Bursell’s book sets out to address this imbalance.

As Bursell notes, trust is one of those concepts that most of us understand intuitively, even if we cannot accurately express its meaning. Indeed, that’s part of the problem. The issue of trust is so deeply wired into the human brain that we may have difficulty accessing it in a productive, conscious way. We might speak about trust using our own definition, but the person we’re speaking with hears a different definition.

The book set me thinking that what we call trust is probably a brain stem function that predates the existence of modern homo sapiens. If two animals encounter each other in the wild, they are wired to either trust, or distrust each other. Survival depends on a fast, accurate trust reflex. So it goes in modern human society and computing, as well.

Bursell has his work cut out for him. He does an admirable job of breaking down trust into elements the reader can understand and apply to computing and security tasks. He draws on sociology and philosophy to offer a basic definition of trust, which is “the assurance that one entity holds that another will perform particular actions according to a specific expectation.”

However, as he quickly adds, things can get a lot more complicated in a computing context. In computing, we have at a minimum trust between user and system, from system to system, and entity to entity. Plus, as Bursell points out, trust is always contextual, and one of the contexts is always time. Nor are trust relationships symmetrical. Your device may trust data coming from Amazon Web Services. But that does not mean that AWS trusts your device.

Bursell offers a relatable example. You might trust your brother. Do you trust your brother to perform brain surgery on you, though? You trust your brain surgeon to perform surgery, but what if your surgeon operated on you 20 years ago. Now, he’s 80 years old. Do you still trust him to perform surgery? That’s the time context. AWS might trust your device for the next 10 minutes, but not next year, if it has not re-authenticated it.

The book then takes these fundamental precepts of trust and applies to the wide and messy world of computing and the cloud. He explores trust in the context of computer and network security, looking at the complexities of trust in system design and the challenges of implementing system-to-system trust. The book looks at the concept of Zero Trust (ZT), which is one of today’s most prominent applications of trust principles in cybersecurity.

Later chapters deal with trust in Blockchains, open source software, hardware and the cloud. He discusses trust domains and communities of practice for trust inside organizations. For hardware, Bursell focuses on the “root of trust,” which is a critical enabling factor in systems that depend on trusted hardware to function securely. Bursell is thorough and pragmatic throughout. This book is a great resource for anyone who needs to understand trust and its many manifestations across the worlds of computing, cybersecurity and business.

 

 

 

Thought Leader Video: Casey Allen from Concentric on Democratizing Cybersecurity

In this video, Casey Allen, CIO of Concentric, argues that cybersecurity needs to be more accessible to consumers and smaller businesses. It needs to be “democratized.” As he sees it, large enterprises have the resources to invest in hardening themselves against attack, which leaves everyone else vulnerable to increasingly automated and sophisticated threats, such as “ransomware-as-a-service.

https://www.youtube.com/watch?v=iZlxi542UpY

Quantifying Cyber Risk

Consider the following common scenario, which is unfolding in executive suites and corporate boardrooms across the world: A Chief Information Security Officer (CISO) presents the Chief Financial Officer (CFO) with a proposal to invest $10 million in upgrading the company’s cyber defenses. A figure that high will mean taking the proposal to the CEO, and then the board of directors for approval. “Do we really need this?” the CFO asks. “Yes,” the CISO replies. “It’s a ‘must-have.’”

What should the CFO do? Should she/he take the CISO’s word for it? That’s not always a good look in the boardroom. “We need it because the CISO said so” is not a compelling argument, even if the CISO is a credible person. Corporations need data to justify cyber defense investments. In particular, they need data about the financial impact of their cyber risk exposure. If the CFO can present a coherent argument in favor of the investment, she will have a better chance of gaining board approval—and the company will become better protected against cyber risk.

“We need it because the CISO said so” is not a compelling argument, even if the CISO is a credible person.

This process, which seems simple, has emerged as a surprisingly challenging arena for corporate decision-making. C-level executives and boards grasp the concept of risk quantification quite well, in general. They deal with debt risk, market risk, compliance risk, weather risks and all manner of threats to the company’s bottom line. For cyber, it’s turning out to be a lot harder to figure out the costs of failing at risk mitigation.

There are a variety of reasons for this. One issue is communication. The language of IT and cybersecurity is not native to the boardroom. This is partly a generational problem, but it’s also because cybersecurity presents itself as an arcane, almost mystical sphere of activity. Scare tactics and vague notions of catastrophe tend to predominate: sign this check or we face a multi-billion dollar loss at the hands of teens wearing hoodies and the Russian military. Why? I could tell you, but you wouldn’t understand.

To some extent, it’s an emotion-driven decision. Executives are afraid of cyber threats, often with good reason, but fear leads to exaggerated reactions. This is not a good way to run a business. Risks come with costs, and if businesses can get a good sense of what those costs are, they can make intelligent, informed decisions about how much security they need to buy.

This brings up the second major challenge to quantifying cyber risk. It’s just not that easy to do. One approach is to engage with a big consulting firm that will conduct audits and analyze a company’s risk. They present a report that captures the financial impact of cyber risks and then move on. Two difficulties arise with this approach. One is that the analysis is typically static, reflecting risks for a fixed period of time. Cyber risks continually evolve, however, so the analysis will soon become obsolete. And, these firms also often neglect subsidiaries and third-party partners in their assessments.

“Decisions about cyber security should be informed by facts and not guesses…”

I spoke about this challenge with Tom Boltman, VP of Strategic Initiatives at Kovrr, a company that offers technology for financially quantifying cyber risk on demand. According to Boltman, putting a financial price tag on cyber risks involves taking a dynamic, continuous approach. And, it should be data-driven at all times. “Decisions about cyber security should be informed by facts and not guesses,” he said. “What we do is incorporate  multiple sources of data including insurance cyber claims data… to give companies a more grounded view of what a potential loss could be.”

Kovrr’s methodology is complex, but it rests on two core dimensions of cyber risk: frequency and severity. A certain form of cyber incident may be frequent, but not severe. For example, a company might suffer a dozen successful phishing attacks a week. However, if they are quickly remediated, and adequate protections are in place, their financial impact will be quite low. In contrast, if a company’s cloud provider goes down, or becomes a conduit for an attack, that may be a rare but very costly episode.

From there, Kovrr adds factors like the nature of the business and the cyber loss characteristics of its industry peers. They apply multiple cyber  risk models to determine the costs of their potential losses from targeted and systemic cyber events that could result from a cyber attack or the failure of the third-party service provider that they rely on. The process takes into account subsidiaries and third-party relationships. They also evaluate the company’s technology stack, looking at its cyber loss history across multiple industries.

The Kovrr type of risk quantification process yields data that decision-makers can use to evaluate the financial impact of a cyber event. This in turn enables them to better understand the ROI of the cyber investments they are making as well as more strategic risk transfer and insurance placements.  Should they spend $10 million? If their potential loss is $1 million, then the answer is probably “no.” If a data-driven risk quantification pegs their risk at $100 million, then that $10 million investment starts to look like a really smart move.

 

Photo by Tima Miroshnichenko from Pexels

Guest Post: Web Pen-test Checklist…What to Check and How

by Ankit Pahuja

A web pen-test, also known as a penetration test, is an attempt to find vulnerabilities on your website. A web pen-test checklist is a list of items that should be tested on the target site. Web pen-tests are used for many reasons, including compliance audits and security audits. This post will guide you through the steps involved in conducting a successful web pen-test, as well as how to utilize a few useful tools.

What Is a Web Pen Test Checklist?

A web pen-test is an attempt to find vulnerabilities on your website. A penetration test, or pen-test for short, looks at the security of a system by simulating real-life attacks against it. As corporations expand their digital presence in business processes, they are increasingly concerned with website security.

Why Use a Web Pen Test Checklist?

A web pen-test checklist is a list of items that should be tested on the target site. This can aid in the detection and mitigation of any prospective threats. Having a checklist also helps to ensure that all aspects of the website are covered, including both the front-end and back-end. It also helps to ensure that all items are tested.

Web Pen Test Checklist

A web pen-test is a method for testing your website’s security. A penetration test, also known as a pen test, is an attempt to identify flaws in a system using real-world assaults. As businesses take over digital territory in their business processes, many organizations are placing more emphasis on the security of their websites. This is the checklist to keep track of when planning a web pen-test-

  • Identify the target website.
  • Determine the goals of the pen test.
  • Gather information about the target website and its users.
  • Select the right tools to use in the pen test.
  • Conduct reconnaissance of the target website.
  • Find and exploit vulnerabilities on the target website.
  • Conduct pentesting.
  • Attack the target website using the selected tools.
  • Report on findings and conclusions from the pen test.

Tools Available For a Web Pen Test

There are a variety of tools for performing a web pen test. Some of the most popular ones include:

  • Astra Pentest
  • Metasploit Framework
  • Nmap
  • Burp Suite
  • WebInspect
  • OWASP Zed Attack Proxy (ZAP)
  • Acunetix WVS
  • Nikto

These are just a few examples, and there are many more tools available. Each tool has its own strengths and weaknesses, so it is important to choose the right one for the job.

Outline for A Web Pen Test

Now that you know what a web pen test is and some of the benefits of using one, let’s walk through the basics parts for conducting one. The following phases will outline how to plan and execute a successful web pen test:

  • Planning Phase – In this phase, you should start by choosing the right tools for your pen test. It is also critical that you identify the correct items to target during testing and determine what type of access testers will require throughout this phase.
  • Executing Phase – In this step, it’s important that you carefully execute both manual and automated techniques as part of a comprehensive test. Testers should also be aware of the legal implications of their activities during this phase.
  • Reporting Phase – The final stage is to compile all findings and present them in a detailed report. This will help organizations understand the risks associated with their website and determine what steps need to be taken to improve security.

By following these simple steps, you can conduct a successful pen-test to identify vulnerabilities in your website.

Steps To Conduct a Web Pen Test

Now that you know what a web pen-test is and why you should use a checklist, let’s walk through the steps of how to conduct one.

  • Get a list of relevant URIs

When starting your web pen test, this is the first step you should take. You will need to collect all potential target sites and group them together by relevance. This step can be done automatically using tools such as Burp Suite’s Site Map function or manually with Google Dorks. Make sure to include all potential subdomains and parameters in your list.

  • Scan the target site for vulnerabilities

Once you have your list of URIs, it is time to start scanning them for vulnerabilities. This can be done with a variety of tools, including Burp Suite, Astra Security, OWASP ZAP, and Acunetix WVS.

  • Analyze the vulnerabilities discovered

Now that you have found all of the vulnerabilities, it is time to analyze them and see which ones are actually exploitable. This step will also include determining what aspects of your site can be exploited using each vulnerability (e.g., cross-site scripting (XSS) vs redirects). This information can be used to prioritize the vulnerabilities and create a remediation plan.

  • Fix the vulnerabilities

Once you have determined which vulnerabilities are most important, it is time to start fixing them. This process can be difficult and time-consuming, but it is necessary for ensuring the security of your website. Make sure to test your fixes before putting them into production to ensure that they work properly.

Conclusion

A web pen-test checklist is an important tool for identifying website vulnerabilities. By following the steps outlined in this article, you can create your own checklist and use it to find and fix security flaws in your website.

 

Ankit Pahuja

Author Bio: Ankit Pahuja is the Marketing Lead & Evangelist at Astra Security. Ever since his adulthood (literally, he was 20 years old), he began finding vulnerabilities in websites & network infrastructures. Starting his professional career as a software engineer at one of the unicorns enables him in bringing “engineering in marketing” to reality. Working actively in the cybersecurity space for more than 2 years makes him the perfect T-shaped marketing professional. Ankit is an avid speaker in the security space and has delivered various talks in top companies, early-age startups, and online events. Linkedin: https://www.linkedin.com/in/ankit-pahuja/

 

Mathieu Gorge, CEO of VigiTrust on China’s New Personal Information Protection Law (PIPL)

In this Thought Leaders video from Cyber Policy Institute, our sister organization, Mathieu Gorge, CEO of VigiTrust, discusses the impact of China’s New Personal Information Protection Law (PIPL) on companies doing business in China.

Thought Leader Video: Tenable’s Jamie Brown discusses public/private partnerships for cybersecurity

Starting in January, 2022, our sister organization, the Cyber Policy Institute began interviewing cyber security thought leaders from industry and government. The very first interview in the series features Jamie Brown, Senior Director of Global Governmental Affairs at Tenable Security discussing public/private partnerships for cybersecurity. https://youtu.be/zFSUpdzBSQE

Securing the Building Management Systems (BMS)

I’m old enough to remember when elevators told you what floor they were on using a needle that looked like something from a grocer’s scale. Admittedly, that was a building built in the 1920s, but the truth is it really wasn’t that long ago that building management was entirely analog. Not anymore. Today’s buildings invariably feature a sophisticated Building Management System (BMS) that monitors and controls core building functions like HVAC, fire alarms, lighting, power and more.

A BMS falls into the operational technology (OT) category. Like most OT systems today, BMS’s are now connected with IT networks, which creates risk exposure. “OT and IT have converged in the BMS space,” explained Megan Samford, VP, Chief Product Security Officer for Energy Management at Schneider Electric, which produces BMS’s. “There are no air gaps, realistically. An OT system can be an attack surface that threatens any connected IT system. Your HVAC becomes a hacker’s way into your email server, and so forth. These are the kinds of risks that our industry is working to mitigate.”

Reducing risk exposure means securing the BMS. This is partly a matter of process and controls. For example, one best practice is to adopt a secure reference architecture for a building that involves effective network segmentation, event monitoring and intrusion detection. Security teams representing both the IT and OT sides of a facility also need to come together to coordinate their work and systems. However, at a foundational level, the BMS itself must be developed using secure principles.

For Schneider Electric and its peer firms in the BMS industry, creating a secure BMS means adhering to the International Electrotechnical Commission (IEC) 62443 standard, which was developed to address the unique security issues affecting industrial automation and control systems (IACS) and OT. IEC 62443 takes on the complex challenges inherent in securing OT systems, some of which are legacy and not easy to defend, while also protecting IT systems that are connected to OT.

According to Samford, the best practice is to employ IEC 62443 in a “defense in depth” approach. She said, “It’s about a layered approach to defense within an OT network. It starts with the people and process, but also encompasses individual products and components that make up the system.”

Megan Samford, VP, Chief Product Security Officer for Energy Management at Schneider Electric

In particular, Samford called attention to section 3-2 of the standard, which relates to “Security Risk Assessment, System Partitioning, and Security Levels.” A BMS should have countermeasures based on relevant threats, risk exposure, inherent vulnerabilities, the likelihood of an event and the consequences of compromise—adapting the system to its own risk tolerance for risk. This principle applies both to the design of the BMS as well as its implementation at a given facility.

Then, with IEC 62443-3-3, which covers “System Security Requirements and Security Levels,” the OT team needs to define security assurance levels and cybersecurity functions embedded in whatever products are used the BMS environment. By working through these, and other IEC 62443 parameters, a BMS can achieve certification at a specific level of defense capability. Level 1 means the BMS can withstand an attack from a casual or inexperienced attacker. Level 2 refers to more experienced malicious actors. Levels 3 and 4 are more sophisticated, with level 4 representing nation state actors. As Samford noted, few if any BMS’s in deployment are yet at level 4, but that is coming.

“One point of defense we’re seeing more consistently now is zero trust,” Samford then remarked. “We are starting to assume that attackers are already in the system. We need to defend from the inside, and ZT offers a great countermeasure to that threat.”

What will it take to succeed in deploying, and then sustaining secure BMS’s? For Samford, the first step is to acquire the right technology. “You need a system that’s built for IEC 62443 certification and defense in depth.” However, as she added, “That’s just the start. It’s critical to identify who owns all the various systems and who is responsible for keeping policies up to date and enforcing them. HR might need to get involved, with recruiting people who know how to handle these responsibilities and engaging in cybersecurity training for building management personnel. Security has not been o ne of their areas of responsibility until recently, but now it’s critical.”

Privacy Policy