Re: Penetration test report - your comments please?

[simonis <simonis () myself com>]

Curt Wilson wrote:
> The www.<sitename.com> system is currently running at <ISP> and does not
> have any type of firewall or other access control mechanism in place that I
> am aware of. Therefore, this audit is only reflective of the current state
> of the system. Network and host remote vulnerability conditions were tested
> for, with the exclusion of Denial of Service (DOS) and brute-force attacks.
> I was unable to penetrate into the operating system or database within the
> allotted time, therefore it is likely that <sitename.com> is fairly secure
> from all but the most determined attackers or those with pre-existing access.

I wouldn't feel comfortable making this claim based on 3 hours of 
testing, especially given the unusual constraints.  Were I an attacker
I would try social engineering, and I would also try a bruteforce attack
against the database.  Excluding these takes alot away from the overall
value of a penetration test and really turns it into a simple, cursory 
scan.


> Basic recommendations: Disable any unnecessary services and web modules.

I would expand on this.  Since you weren't allowed to do alot with the
test, you should focus on the report as a place to add value.  Specify
which services are known to be easily exploited, give some examples and
some guidance on protecting services that are indeed necessary.

> Apply all necessary patches on a timely basis. 

This could be expanded to not only the application of patches, but also
the necessity of a section in the security policy mandating their 
application.

I'd also be curious as to if they detected your scans.  Alot of people
seem to be in the mind that a penetration test should only evaluate the
security, or "hardness" of the target hosts and perhaps the
effectiveness
of the firewalls.  I also like to include the ability of the IDS systems 
to detect my presence, and how the intrusion was handled.  Is there a
written manual for incident response?  If so, were the procedures
followed,
and were they effective?  There's so much more benefit to be gained from 
a pen-test than just simply "did the host respond to my romance".  

Or maybe I just suffer from eternal scope creep  ;-)