Defining Assessment And Testing - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Defining Assessment and Testing

reconnaissance phase, during which important data regarding the target systems and resources is
gathered. This phase leads to the system readiness phase, whereby the target is essentially checked
for all known vulnerabilities. The readiness phase culminates in the reporting phase, where the
findings are classified into categories of high, medium, and low risk; and methods for improving the
security (or mitigating the risk of vulnerability) of the target are discussed.
If you were to perform a vulnerability assessment of your home, you would likely check each door to
your home to see if they are closed and locked. You would also check every window, making sure
that they closed completely and latch correctly. This same concept applies to systems, networks,
and electronic data. Malicious users are the thieves and vandals of your data. Focus on their tools,
mentality, and motivations, and you can then react swiftly to their actions.
42.2.2. Defining Assessment and Testing
Vulnerability assessments may be broken down into one of two types: Outside looking in and inside
looking around.
When performing an outside looking in vulnerability assessment, you are attempting to compromise
your systems from the outside. Being external to your company provides you with the cracker's
viewpoint. You see what a cracker sees — publicly-routable IP addresses, systems on your DMZ,
external interfaces of your firewall, and more. DMZ stands for "demilitarized zone", which corresponds
to a computer or small subnetwork that sits between a trusted internal network, such as a corporate
private LAN, and an untrusted external network, such as the public Internet. Typically, the DMZ
contains devices accessible to Internet traffic, such as Web (HTTP ) servers, FTP servers, SMTP (e-
mail) servers and DNS servers.
When you perform an inside looking around vulnerability assessment, you are somewhat at an
advantage since you are internal and your status is elevated to trusted. This is the viewpoint you and
your co-workers have once logged on to your systems. You see print servers, file servers, databases,
and other resources.
There are striking distinctions between these two types of vulnerability assessments. Being internal
to your company gives you elevated privileges more so than any outsider. Still today in most
organizations, security is configured in such a manner as to keep intruders out. Very little is done to
secure the internals of the organization (such as departmental firewalls, user-level access controls,
authentication procedures for internal resources, and more). Typically, there are many more resources
when looking around inside as most systems are internal to a company. Once you set yourself outside
of the company, you immediately are given an untrusted status. The systems and resources available
to you externally are usually very limited.
Consider the difference between vulnerability assessments and penetration tests. Think of a
vulnerability assessment as the first step to a penetration test. The information gleaned from the
assessment is used for testing. Whereas, the assessment is checking for holes and potential
vulnerabilities, the penetration testing actually attempts to exploit the findings.
Assessing network infrastructure is a dynamic process. Security, both information and physical, is
dynamic. Performing an assessment shows an overview, which can turn up false positives and false
negatives.
Security administrators are only as good as the tools they use and the knowledge they retain. Take
any of the assessment tools currently available, run them against your system, and it is almost a
guarantee that there are some false positives. Whether by program fault or user error, the result is the
same. The tool may find vulnerabilities which in reality do not exist (false positive); or, even worse, the
tool may not find vulnerabilities that actually do exist (false negative).
587