Re: (preparing for)Pentesting firewall /Checkpoint box

[Francois Yang <francois.y () gmail com>]

My first suggestion would be to not wait until you have a pen test
coming up to ask these questions.
You should have asked them when you or whoever first setup the firewalls.

Not much advise to give you, but I would say;
- make sure you have a secure sic so that it's not easily guesses. ie:
not your company name.
- restrict remote access (ie: ssh) to only a group of computers or network.
- disable web access if you don't need it.
- limit physical access. resetting passwords on splat is actually pretty easy.

-OS side, make sure to have them locked down and patched.

not much, but I hope it helps.

Frank

On Tue, Aug 18, 2009 at 1:47 AM, pent 5971<pent5971 () gmail com> wrote:
> Hi
>
> I would like to ask for your advice on something. Ill have a
> penetration test soon in the enterprise and im need of that nothing
> (configuration mistakes advices etc also) would be found on my
> Checkpoint R65 boxes (both on Windows and Secure Platform) . So what
> can you advice for me to prepare  and also how can i do a pentest to
> these boxes by myself?
>
> Thank you
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
> and CEPT certs require a full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------



-- 
If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked. — White House Cybersecurity
Advisor, Richard Clarke

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------