The testing team has complete carte blanche access to the testing network and has been supplied with network diagrams, hardware, operating system and application details etc, prior to a test being carried out. This does not equate to a truly blind test but can speed up the process a great deal and leads to a more accurate results being obtained. The amount of prior knowledge leads to a test targeting specific operating systems, applications and network devices that reside on the network rather than spending time enumerating what could possibly be on the network. This type of test equates to a situation whereby an attacker may have complete knowledge of the internal network.

No prior knowledge of a company network is known. In essence an example of this is when an external web based test is to be carried out and only the details of a website URL or IP address is supplied to the testing team. It would be their role to attempt to break into the company website/ network. This would equate to an external attack carried out by a malicious hacker.

The testing team would simulate an attack that could be carried out by a disgruntled, disaffected staff member. The testing team would be supplied with appropriate user level privileges and a user account and access permitted to the internal network by relaxation of specific security policies present on the network i.e. port level security.

Hardware failing

Software failing

Human error

Hardware failing

Software failing

Human error

Example: A FAT partition was found. FAT by default does not give the ability to set appropriate access control permissions to files. In addition moving files to this area removes the protection of the current acls applied to the file.

Example: Format the file system to NTFS.

Example: LM Hashes found still being utilised on the network.

Example: Ensure NTLM2 is enforced by means of the correct setting in Group Policy.

Example: Logon success adn failure was not enabled

Example: Ammend appropriate Group Policy Objects and ensure it is tested and then applied to all relevant Organisational Units etc.

Example: Several of the latest Microsoft patches were found to be missing

Example: Ensure a rigorous patching policy is instigated after first being tested on a development LAN to ensure stability. Review the settings on the WSUS server and ensure that it is regularly updated and an appropriate update strategy is instigated for the domain.

Example: Several workstations were found to have out of date anti-virus software. In addition where it was found to be installed the actual product was found to be mis-configured and did not provide on-access protection.

Example: Ensure all workstations are regualrly updated and configured correctly to ensure maximum protection is afforded

Example: Users from one domain were unable to access resources on another tree.

Example: Review transitive and non-transitive trusts and ensure that all relevant trusts have been established.

Example: i.e. Incorrect permission on www root

Example: Apply more stringent permissions or remove various users/groups that currently have access to this area.

Example: Areas of the website that should be Protected did not have any password mechanism enforced.

Example: Ensure areas that require access to be limited are password protected.

Example: Web server logs were not being reviewed for illicit behavious.

Example: Regulalrly review all audit logs.

Example: The latest patch was not applied to the server leaving it susceptible to a Denial of Service Attack.

Example: Apply the latest patch after testing on a development server to ensure compatibility with installed applications and stability of the server is maintained.

Example: The IIS lockdown tool has not been applied to the web server.

Example: Apply the IIS lockdown tool to the server after first testing on a development server to ensure compatibility with installed applications and stability of the server is maintained.

Example: Loose access control permissions were found on directories containing important configuration files that govern access to the server.

Example: Ensure stringent access control permissions are enforced.

Example: Clear text passwords were found stored within the database.

Example: Ensure all passwords, if required to be stored within the database are encrypted and afforded the maximum protection possible.

Example: Reviewing the audit logs from the TNS Listener were not being carried out.

Example: Ensure all relevant audit logs are regularly inspected. Audit logs may give you the first clue to possible attempts to brute force access into the database.

Example: The latest Oracle CPU was not installed, leaving the system susceptible to mutilple buffer and heap overflows and possible Denail of Service attacks.

Example: Install the latest Oracle CPU after first trsting on a development server to ensure adequate compatibility and stability.

Example: Numerous extended stored procedures were directly accesible by the public role.

Example: Ensure the public role is revoked from all procedures that direct access is not required or utilised.

Example: Clear text Link passwords were discovered.

Example: Ensure all Link passwords are encrypted, review the requirement to utilise these Links on a regualr basis.