WTF.uzz

All the CXO, security enthusiasts know this term – Pentest (Penetration Testing). What is pentesting  and how has it evolved all these years? Is it catching up with the hackers of this century, or now this trend is just side tracked? Pentest as per Wikipedia, is a method of evaluating the security of a computer system or network by simulating an attack from a malicious source, known as a Black Hat Hacker, or Cracker.

Do you agree with this? If you or your fellow mate is a pentester, ask him. There has been a global change on how the pentesting is perceived by both sides of the table – the clients, as well as the consultants. Pentesting is no more in sync with an act of a hacker, or cracker; rather it is a checklist that the compliance team has to follow – the PCI, the HIPAA, blah blah. It was a deed of a handful of professionals but is now falling into hands of “anyone” who are employed by the security services firms. Now, what’s the deal here with the pentesters and what’s happening? The actual geeky work has been taken over by the tools, and the professionals are responsible for executing them, verifying the findings, and generating reports accordingly. Tools like Nessus, App Scan, Nmap, Metasploit, Core Impact etc. are pretty much self sustaining in the pentesting environment and soon they will even deliver a well drafted report as per the template supplied.

Any tool available in the security world handles 75% vulnerabilities, and companies are happy in fixing them. But, what about the rest of 25% vulnerabilities? Aren’t they important? Irony is this 25% should be of more concern to a company. Attacker, or hackers will use these 25% to compromise your resources rather than relying on 75% of shit hanging there which any script kiddie is able to run a tool and exploit. Initially there was a time (years back) when vulnerability scanning was on hype. But, soon it just got vanished in the dark clouds … and so will Penetration Testing. Firms hire professionals to pentest  their network, servers, perimeter security controls and what’s the end result is a report which is 90% filled with findings of a tool or software, and some recommendations and remediation. The actual pentesting environment is fading exponentially fast.

An Update: I had to complete my blog, but someone shared THIS LINK (a highly recommended reading) with me meanwhile, and I can say there are other people who definitely agree with me and I am not an alien. This link says what’s all in my head in a better influential way.

Peace.