An enterprise suspects leakage of confidential information to competitors, because of frequent bid loss recently. Senior management would like to have an external party (security service provider) to find out if there exist possible channels, that internal or external hackers leaking out or sniffering bid information.
What should be involved in a Penetration Test for Data Loss Prevention:
1. Define Objectives of the Penetration Test
- What area is going to be evaluated? (DLP, etc)
- What are required to be found out? (Vulnerabilities, Risks, Recommendations)
2. Define the Scope of Penetration Test (ie. The Investigation Focus)
Service provider has better to spend most effort in this part in the early phase of project.
- What are being investigated? ...data loss (DL) in this case
(DL via email, **
DL via removable medias,
DL via other service (eg. Web Portal, File Server to external)
DL via physcial access
DL via network level attack)
- Taking DLP via Email as an example, analyse what are the possible "cause" of data loss?
(Human Factors - e.g., user mistakes or being social engineering attack,
Under Password Attack - e.g., brute force attack,
Machine Remote Controlled - e.g., PC or server being controlled and email box can be easily accessed,
Login Credential Sniffed - e.g., by sniffing on network,
etc.)
- Not at the causes can be proved/tried in the pentest, especially when limited budget or resources are available. Should works according to priorities. For example, enterprise would focus on "Machine Remote Controlled" and "Login Credential Sniffed", this could be because these are usually the high risk area that the service provider/enterprise has experienced.
- Service provider will plan the pentest by assuming herself as the possible internal/external hackers who steal data by
(A) "remotely control on target machine (email server in this example)" and
(B) "sniffing (email) login credential".
3. State Assumptions
State role and responsibility of service provider and enterprise and what are excluded, which could otherwise become controversy.
4. Standard and Guideline that the pentest follows
(for example)
- White Hat. Inc
- ISO 17799
5. Explain the Methodology
(as from open standard or service provider usual practice.)
6. Zero Knowledge Pentest (Step-by-step what to do)
- Targets service (Email, WebMail, Some other important related services)
- Netcraft Search Web by Domain
- DNS Whois Query
- Domain Lookup
- Traceroute
- ICMP Traffic Test
- Sifting Contents by Server and by Google
- SSL Server Certificates
- Identified Services
- Email OWA Passward Guessing
- Identified Vulnerabilities
7. Internal Vulnerability Assessment (Step-by-Step what to do)
(for example, if focus on wireless network...)
- Wireless access points
- Devices that connected to wireless network
- Vulnerabilities identified in access points and end-point devices
8. Recommendations
bla bla bla based on the foundings... :)
~~~~~
Again, the above is not a complete security review on DL. Instead, this exercise is a pentest against certain high risk DL areas, like possibly infected email and important servers, wireless access point, and the endpoint device that connected to access point, etc.
