The Effectiveness of Penetration Testing in IT Systems
Advisor: Aaron Glanzer
Internship Location: Casepoint, LLC.
Onsite Mentor: Usha Raj
With more companies turning to cloud-based platforms to conduct their business, it is important for them to make sure their IT systems are secure so that any attempts to break into them do not result in the leak of any sensitive employee, vendor, or client data. Over the past decade, experts have been conducting studies on various IT security testing methods and how effective they are at revealing vulnerabilities in networks. Penetration testing (or pentest) -- an authorized cyberattack on a network -- has become a very popular security testing method. However, there haven’t been many studies to test how effective it really is. With my project, I aim to conduct further research and investigations to determine how effective penetration testing is at revealing vulnerabilities in IT systems, specifically web servers and API’s (Application Programming Interfaces). I will work as an intern for Casepoint, LLC, an IT solutions company. Casepoint has a pentest team that will conduct various penetration tests on a series of networks, mainly web servers and API’s, to see how many vulnerabilities they contain. After each test, reports are written on them to detail what the pentesters discovered, particularly the number of vulnerabilities they were able to discover in the network they hacked. I plan to use this as a measure of the effectiveness of pentest. The reason why this study is important is because it is important for a company to properly secure its networks to prevent any cyberattacks or prevent them from ruining its reputation.
Project Blog
Post 1: Introduction
Hi, everyone!
Arnav here and very soon I am going to begin my senior project. The main focus of my project will be Cybersecurity, particularly on penetration testing (or pentest). Pentest is a popular IT security testing method in the corporate world. In the past decade, it has increased in popularity. However, despite the popularity, there hasn’t been too many studies on it. That’s why for my project I plan to learn how effective pentest is as revealing vulnerabilities in IT systems.
For my internship, I will be working for Casepoint, LLC. Specifically, I will working with their pentest team, a team of ethical hackers that will carry out penetration testing, to conduct multiple tests on Casepoint’s various networks. I hope that this experience will be the primary guide for my research. I have yet to begin my internship, though, so for now, I will turn my focus to researching scholarly articles on how penetration testing has been used over the past decade. I also plan to draw on the knowledge of any studies that tested its effectiveness.
Week 1
Hi, everyone!
I am yet to start my internship, but I can’t wait for it to begin! I think this will be a valuable experience for me, as not only will it give me work experience, but it will also help me gain knowledge on how important IT security is in the corporate world. This is going to be key to the success of my research on penetration testing, as testing its effectiveness will be useful in determining how best to improve network security. This is because as time goes on, more cyberattacks are bound to happen, so the constant evaluation of security testing methods will always be necessary.
Anyways, that’s what I have for now. As I begin my internship and make more progress in my research, I will learn new things as I go on.
Week 2: The Internship Begins
Hi, everyone!
This past week I began my internship with Casepoint. I started with getting an introduction about pentesting. I am currently going through some of the resources provided by Casepoint, which will teach me many interesting things about IT security. One notable piece of information I learned about was how many different vulnerabilities I have to know about. I learned that part of what makes security testing so difficult is that sometimes it is difficult to tell which vulnerabilities are which and what methods I can use to solve them, since there is so much to know. I will continue to post what I learn as I go through the resources. I intend on using what I learn when conducting research in the future.
Week 3: Training
This week, I continue my training on pentesting that I began last week. Doing this has helped me learn more and more about pentesting, why it’s important, and how it is conducted.
One thing I learned this week is the process of reconnaissance. Reconnaissance is the information-gathering stage of pentesting, where you collect data about the target system. There are two types of reconnaissance: passive and active. With active reconnaissance, hackers interact directly with the computer system and attempt to obtain information through techniques like automated scanning or manual testing. Active reconnaissance is generally faster and more accurate, but is riskier because it creates more disturbance in a system and has a higher chance of being detected. Passive reconnaissance, on the other hand, gathers information about targeted computer networks without directly interacting with them, making it the safer and more popular method.
Reconnaissance is essential for successfully conducting a pentest, and it is something I will carry out as I conduct my own pentests.
Week 4: Research
Hi, everyone! Sorry for posting this late. I’ve been experiencing technical difficulties, but I’ve gotten back on track. This blog and the next one are coming in soon.
I spent this week researching IT security testing to determine what I should focus my research on. Multiple studies have been conducted on pentesting and how it fares versus other IT security testing methods, like the vulnerability assessment. One study done by a California State University student says that pentesting can be more effective than standard vulnerability assessments, but has limitations such as scope, time, and budget. According to her, though, this can be solved by making some or most of the tasks in penetration testing automated, meaning little human interaction, making it much easier for organizations to deal with these limitations. The studies that I looked at so far have been very helpful to me. However, it is possible that these studies have limited scope, as most of them were conducted in the past decade. Still I still think it is very important to look at the past to see what previous researchers have done and learn how I can build on that. I look forward to learning more about pentesting and IT security testing as I do more research.
Week 5: Continuing Research
Hello, everyone! This week, I continued my research on past studies about IT security testing. However, while doing so, I came across some useful resources.
One of these resources was the National Vulnerability Database. The NVD was created by NIST (National Institute for Standards of Technology), and is basically a repository of various vulnerability management standards that need to be met by all corporations. It contains a list of all vulnerabilities that have been reported in computer systems, adding new vulnerabilities as they are found. I have found the NVD to be the most useful resource available to me, as going through it has helped me learn what I should expect to see when conducting a pentest and how I determine which vulnerabilities are which.
Another useful resource that I came across was the SEC website. I learned that it can be used by a pentester to look up information on a company that hired them. One thing that pentesters must do is discuss with the corporation that hired them about the boundaries that need to be set. Corporations need to tell which networks are allowed to be tested and which are not. If pentesters fail to follow the rules, they will get in trouble. This is one major limitation of pentesting, as not all necessary information is provided to successfully conduct tests. With the SEC website, though, pentesters can look up what they’re allowed to know on corporations.
These resources have given me insight into what I will be looking for when conducting pentests, as well as the limitations of my project.
Week 7: Consolidating My Work
Hey, everyone! Sorry for the delay in this post. I’ve once again been experiencing technical difficulties with the blogging site. However, I am back and ready to update you all with what I have done so far.
I spent the 7th week of my Senior Project consolidating what I have done in my final paper. I began with creating an outline for how to organize my paper. Luckily, I can look back on my project proposal and expand on what I have written there, as it provides the baseline on what my project is about. So far, I have focused on writing about my research on how pentesting works and how it has evolved over the past decade. As for my internship, I have been provided with urls that I can use to test different vulnerabilities and how they affect networks. I will touch on that more next week, however, as I have not done much with them yet. Going back to my research, I have learned that doing studies on pentesting can sometimes be difficult, as a standard pentest can go up to two weeks long. There is an entire process involved with it, including information gathering (reconaissance), pre-engagement interactions, as well as the actual testing. It will be difficult for me to do a full analysis of different pentests, as there is a lot to look at in each of them.
Anyways, that’s all for this week! Next week, I’ll dive into what I learned by testing different urls.
Week 8: Testing…Testing…
Hey everyone! This past week I began testing some networks of my own using Nessus Essentials, a very handy pentesting tool. There are many different parts of it that make my work easier to complete. For example, for every vulnerability found in any tested networks, Nessus provides a very detailed explanation of what those vulnerabilities are, giving me more to work with when analyzing my findings. Nessus also uses the CVSS (Common Vulnerability Scoring System, assesses the severity of computer system security vulnerabilities) to divide each found vulnerability into categories, ranging from Info (no vulnerability, just minor information) to Critical (very severe vulnerability, can be catastrophic if exploited). Nessus can also generate reports after each test gets completed.
As I was saying, I began testing some networks. The results were rather varied for every test that I did. On the one hand, some tests revealed plenty of vulnerabilities ranging from Info to Critical, while others reveal a much smaller amount of vulnerabilities, those tests revealing vulnerabilities ranging from Info to Medium. Analyzing these will help me understand how effective pentesting is depending on the size and type of networks I am working with. For now, though, I am continuing my testing and adding everything that I have discovered to my final paper.
Week 10: The End
Well… this is it! After 10 weeks of work, I am finally finishing my senior project. I’d like to use this last blog to thank all that have supported me throughout the whole process. I want to thank Mr. Glanzer, my faculty advisor, for providing helpful advice for me as I worked for all these weeks. I would also like to thank Casepoint, LLC., especially my on-site mentor, Usha Raj, for providing me with the opportunity to intern for them, and BASIS Independent McLean for helping me begin this project. Next Thursday, I will be presenting my work in the Senior Showcase, which will be an amazing experience. That’s all for this post!