Comments on: The value of automated Security Tests http://www.gnucitizen.org/blog/the-value-of-automated-security-tests/ Information Security Think Tank Sat, 02 Feb 2013 17:50:40 +0000 hourly 1 http://wordpress.org/?v=3.4.1 By: db http://www.gnucitizen.org/blog/the-value-of-automated-security-tests/comment-page-1/#comment-81523 db Wed, 05 Dec 2007 16:12:11 +0000 http://www.gnucitizen.org/blog/the-value-of-automated-security-tests#comment-81523 People (sysadmin's I worked with) would tell me that you could never automate system builds, but as the tools got better and the faith in the tools got better the reliance on automation increased. Currently some companies rely on automation so much that they do not have the skilled labor to know when their automation has gone to the dogs. Automation should only be used to assist a professional and not an a replacement for the skills that are needed to protect your data/infrastructure/person. However I am repeating what has been said before, it is worth repeating. People (sysadmin’s I worked with) would tell me that you could never automate system builds, but as the tools got better and the faith in the tools got better the reliance on automation increased. Currently some companies rely on automation so much that they do not have the skilled labor to know when their automation has gone to the dogs.

Automation should only be used to assist a professional and not an a replacement for the skills that are needed to protect your data/infrastructure/person.

However I am repeating what has been said before, it is worth repeating.

]]> By: djteller http://www.gnucitizen.org/blog/the-value-of-automated-security-tests/comment-page-1/#comment-81508 djteller Wed, 05 Dec 2007 15:11:21 +0000 http://www.gnucitizen.org/blog/the-value-of-automated-security-tests#comment-81508 I do believe that a skilled h4kur will produce much more valuable report than a scanner but: Today big organizations usually hire more than one penetration testing team, since they want different opinion about their security deployment. A mix between a person and an automated script/service will produce a reliable report. 2 days ago in OWASP Israel conference i came across a new Startup company that provide an online automated penetration service, (gamasec.com), they tailor their service to each customer. Combining services such as this PLUS a real manual penetration test twice a year by a skilled individual is the right approach. P.S - pdp i agree with you, that's a dark topic that no-one really wants to talk about, so i'm done here as well :) I do believe that a skilled h4kur will produce much more valuable report than a scanner but: Today big organizations usually hire more than one penetration testing team, since they want different opinion about their security deployment. A mix between a person and an automated script/service will produce a reliable report.

2 days ago in OWASP Israel conference i came across a new Startup company that provide an online automated penetration service, (gamasec.com), they tailor their service to each customer. Combining services such as this PLUS a real manual penetration test twice a year by a skilled individual is the right approach.

P.S – pdp i agree with you, that’s a dark topic that no-one really wants to talk about, so i’m done here as well :)

]]> By: flipper http://www.gnucitizen.org/blog/the-value-of-automated-security-tests/comment-page-1/#comment-81500 flipper Wed, 05 Dec 2007 14:54:54 +0000 http://www.gnucitizen.org/blog/the-value-of-automated-security-tests#comment-81500 Thanx, and they call it "audit company". I guess most of us been through such experience. Thanx, and they call it “audit company”. I guess most of us been through such experience.

]]> By: pdp http://www.gnucitizen.org/blog/the-value-of-automated-security-tests/comment-page-1/#comment-81491 pdp Wed, 05 Dec 2007 14:45:25 +0000 http://www.gnucitizen.org/blog/the-value-of-automated-security-tests#comment-81491 nice wrap up :) nice wrap up :)

]]> By: flipper http://www.gnucitizen.org/blog/the-value-of-automated-security-tests/comment-page-1/#comment-81489 flipper Wed, 05 Dec 2007 14:43:04 +0000 http://www.gnucitizen.org/blog/the-value-of-automated-security-tests#comment-81489 Always is a matter of choice..and the choose you make is always a compromise. Companies, often believe in what other companies do..that's why often they copy mistakes from one to each other (way solution are implemented, equipments brands, software, OS..almost everything)...so unavoidable they believe in others companies testing software. Of course it's only about scanning for some vulnerabilities...but companies risk a lot..very much. They think that covering with patches and updates will solve the problem.Nope. No way u can do it like this. Becoming a h4ker..knowing what can be done is the way..But of course..to use this valuable knowledge ('cause u won't find "Hacking for Idiots" on every corner as being a good material, and it's perfectly understandable) in a good manner, for protecting yourself and upgrade your security level. In this case... definitly u need a h3ker to evaluate, or become one... :) Always is a matter of choice..and the choose you make is always a compromise.

Companies, often believe in what other companies do..that’s why often they copy mistakes from one to each other (way solution are implemented, equipments brands, software, OS..almost everything)…so unavoidable they believe in others companies testing software. Of course it’s only about scanning for some vulnerabilities…but companies risk a lot..very much. They think that covering with patches and updates will solve the problem.Nope. No way u can do it like this. Becoming a h4ker..knowing what can be done is the way..But of course..to use this valuable knowledge (’cause u won’t find “Hacking for Idiots” on every corner as being a good material, and it’s perfectly understandable) in a good manner, for protecting yourself and upgrade your security level.

In this case… definitly u need a h3ker to evaluate, or become one… :)

]]> By: pdp http://www.gnucitizen.org/blog/the-value-of-automated-security-tests/comment-page-1/#comment-81431 pdp Wed, 05 Dec 2007 12:19:56 +0000 http://www.gnucitizen.org/blog/the-value-of-automated-security-tests#comment-81431 flipper, yes of coures, a h4kur without tools is of no use to anyone. However, my point was quite different. All I am trying to say here is that while automated test (automated vulnerability assestment tools, this does not include nmap but mostly Nessus and the clones plus those used in the WebApp world) are of no use if you really want to know how an attacker can penetrate your network or applications. They will show you all your vulnerabilities (as far as they can) but they won't show you how an attacker can gain access without using any vulnerability whatsoever or how an attacker can come up with a combination of attacks. It think that it is really a matter of choice. flipper, yes of coures, a h4kur without tools is of no use to anyone. However, my point was quite different. All I am trying to say here is that while automated test (automated vulnerability assestment tools, this does not include nmap but mostly Nessus and the clones plus those used in the WebApp world) are of no use if you really want to know how an attacker can penetrate your network or applications. They will show you all your vulnerabilities (as far as they can) but they won’t show you how an attacker can gain access without using any vulnerability whatsoever or how an attacker can come up with a combination of attacks.

It think that it is really a matter of choice.

]]> By: flipper http://www.gnucitizen.org/blog/the-value-of-automated-security-tests/comment-page-1/#comment-81423 flipper Wed, 05 Dec 2007 12:03:31 +0000 http://www.gnucitizen.org/blog/the-value-of-automated-security-tests#comment-81423 In In think this subject can be detailed in many ways, and can lead to many different opinions. Hiring a h3ker would be a plus considering the interpretation it might give to his analysis.. But good choice “analysis”, because often that we might admit, it relays (al least in some points) on…”scanners” Of course it relays on scanners, and more often is ..nmap. Why? Cause It’s the nearest tool to see what services are available in a public manner and which of them are not suppose to be. As you mention…”combinations of tricks” is the key. Yes, it is! No scanner I know can do this (at the moment), but I don’t really find it impossible at all..scenarios can be scripted in templates and modulated as an AI…like in the games (I’m no gamer, ..just to mention). So, getting back to “combination of tricks”, a h3ker mind can go much further that considering some port opened, or not, ..or a service available or not. It can do tests based on the vulnerabilities of that version..or missconfigurations. And this is a big +. Of course hiring a h3ker is somehow ..not enough..he need the tools..just his AI is just not enough, and no one has that time to reinvent the wheel…to script new nmap (just an example) to scan a server. Is a conclusion of my thoughts…I think scanners without AI is to few..and a good AI without the tools ..is big time consumption, effort and it came be easily a failure. In In think this subject can be detailed in many ways, and can lead to many different opinions. Hiring a h3ker would be a plus considering the interpretation it might give to his analysis..

But good choice “analysis”, because often that we might admit, it relays (al least in some points) on…”scanners” Of course it relays on scanners, and more often is ..nmap. Why? Cause It’s the nearest tool to see what services are available in a public manner and which of them are not suppose to be.

As you mention…”combinations of tricks” is the key. Yes, it is! No scanner I know can do this (at the moment), but I don’t really find it impossible at all..scenarios can be scripted in templates and modulated as an AI…like in the games (I’m no gamer, ..just to mention).

So, getting back to “combination of tricks”, a h3ker mind can go much further that considering some port opened, or not, ..or a service available or not. It can do tests based on the vulnerabilities of that version..or missconfigurations. And this is a big +.

Of course hiring a h3ker is somehow ..not enough..he need the tools..just his AI is just not enough, and no one has that time to reinvent the wheel…to script new nmap (just an example) to scan a server.

Is a conclusion of my thoughts…I think scanners without AI is to few..and a good AI without the tools ..is big time consumption, effort and it came be easily a failure.

]]>