Late last year SANS conducted a survey on application security practices in enterprises. One of the questions asked in the survey was how often organizations are doing security testing. The responses were:
- No security testing policy for critical apps: 13.5%
- Only when applications are updated, patched or changed: 21.3%
- Annually: 14.3%
- Every 3 months: 18.0%
- Once a month: 9.5%
- Ongoing: 23.3%
What was most interesting to me is that almost of organizations are doing security testing on an ongoing, near-continuous basis — testing applications as they are being developed or changed.
The only way to test this frequently, and the effective way to scale security testing in large enterprises with thousands of applications and hundreds of web sites, is by relying heavily on
Penetration testing is one of the bulwarks of an application security program: get an expert tester to simulate an attack on your system, and see if they can hack their way in. But how effective is application penetration testing, and what should you expect from it?
Gary McGraw in Software Security: Building Security In says that
Passing a software penetration test provides very little assurance that an application is immune to attack
This is because
It's easy to test whether a feature works or not, but it is very difficult to show whether or not a system is secure enough under malicious attack. How many tests do you do before you give up and decide "secure enough"?
Just as you can't "test quality in" to a system, you can't "test security in" either. It's not possible to exhaustively pen test a large system — it ...
[Cross posted from SANS ISC]
Penetration tests and vulnerability assessments are becoming more common across the whole industry as organizations found that it is necessary to prove a certain level of security for infrastructure/application. The need to exchange test result information is also increasing substantially. External parties ranging from business partners, clients to regulators may ask for prove of tests being done and also results of the test (aka. Clean bill of health).
The sharing of pentest information can create a huge debate, just how much do you want to share? There are at least a couple ways to get this done. The most seemingly easy way to do this is to share the whole report including the summary and also the detailed findings. While this seems easy, the party sharing out the report may be exposing too much information. Pentest reports can be like treasure map to attack an infrastructure
The person I had the IM discussion with was Daniel Miessler. He responded in his own blog, and sent me the excerpt below as a response. Thanks for the offline and online comments to far. Certainly an interesting topic to discus!
Is a pentest done after you got root? Or is this just the start of finding even more vulnerabilities? In my opinion, a pentest should aim at finding as many vulnerabilities as possible.