Syarat Penerbitan Electronic Banking Di Indonesia Mengacu 9/15/PBI/2007 dan SEBI 9/30/DPNP

 

(gambar ilustrasi)

Postingan kali ini saya akan membahas tentang proses penerbitan layanan electronic banking (E-Banking) di Indonesia sesuai dengan syarat yang telah ditentukan oleh Badan Regulator (Bank Indonesia dan Otoritas Jasa Keuangan). Mungkin ada beberapa kita yang masih bingung langkah apa saja yang harus dilakukan jika ingin menerbitkan layanan E-Banking.

Sebelum masuk ke inti perijinan, alangkah baiknya jika kita terlebih dahulu mengenal apa itu E-Banking. Jika mengacu dari SEBI 9/30/DPNP pengertian E-Banking adalah layanan yang memungkinkan nasabah Bank untuk memperoleh informasi, melakukan komunikasi, dan melakukan transaksi perbankan melalui media elektronik seperti Automatic Teller Machine (ATM), phone banking, electronic fund transfer (EFT), Electronic Data Capture (EDC)/Point Of Sales (POS), internet banking dan mobile banking. (Kurang SMS Banking & Rekening Ponsel)

Jadi semua layanan yang berbasiskan electronic seperti disebutkan diatas maka wajib mengacu ke peraturan 9/15/PBI/2007 dan SEBI 9/30/DPNP. Jika tidak mengacu ke peraturan tersebut pastinya ada sanksi yang akan diterima oleh Bank. Pembahasan yang berkaitan dengan E-Banking pada 9/15/PBI/2007 diatur di Bab V sampai Bab VIII. Semua Bank harus bisa mematuhi aturan main disitu.

Disini saya coba membahas syarat-syarat yang harus dipenuhi apa saja sih dan saya akan jabarkan dari pasal-pasal yang disebutkan di PBI dan bahasan yang ada di SEBI tersebut.

Pasal 23

- Ayat 1 = Setiap rencana penerbitan produk Electronic Banking baru harus dimuat dalam Rencana Bisnis Bank.

- Ayat 2 = Setiap rencana penerbitan produk Electronic Banking yang bersifat transaksional wajib dilaporkan kepada Bank Indonesia paling lambat 2 (dua) bulan sebelum produk tersebut diterbitkan.

*Pengertiannya bahwa Bank harus memasukkan didalam Rencana Bisnis Bank (RBB) jika ingin mengadakan layanan E-Banking dan juga IT Strategic Plan (ITSP) Bank tersebut harus selaras dengan RBB. Contoh di tahun 2020 Bank XYZ ingin menyediakan layanan Internet Banking, maka sebelumnya harus dituangkan juga di ITSP bagaimana pihak IT untuk mendukung layanan tersebut. Mulai dari rencana penyiapan infrastruktur, sumber daya manusia, framework yang digunakan, dll.

Nah hal-hal apa saja yang perlu disiapkan dalam mengirimkan dokumen-dokumen pendukung untuk laporan yang akan dikirimkan kepada pihak regulator dapat mengacu ke Pasal 23 ayat 2 yang menyebutkan:

Laporan rencana penerbitan produk sebagaimana dimaksud pada ayat (2) wajib dilengkapi dengan hal-hal sebagai berikut:

a. bukti-bukti kesiapan untuk menyelenggarakan Electronic Banking yang paling kurang memuat:
1) struktur organisasi yang mendukung termasuk pengawasan dari pihak manajemen;
2) kebijakan, sistem, prosedur dan kewenangan dalam penerbitan produk Electronic Banking;
3) kesiapan infrastruktur Teknologi Informasi untuk mendukung produk Electronic Banking;
4) hasil analisis dan identifikasi risiko terhadap risiko yang melekat pada produk Electronic Banking;
5) kesiapan penerapan manajemen risiko khususnya pengendalian pengamanan (security control) untuk memastikan terpenuhinya prinsip kerahasiaan (confidentiality), integritas (integrity), keaslian (authentication), non repudiation dan ketersediaan (availability);
6) hasil analisis aspek hukum;
7) uraian sistem informasi akuntansi;
8) program perlindungan dan edukasi nasabah.

b. hasil analisis bisnis mengenai proyeksi produk baru 1 (satu) tahun kedepan.

Serta jangan lupa ayat lanjutan pada ayat 5, yaitu:

Penyampaian pelaporan sebagaimana dimaksud dalam ayat (2) harus dilengkapi dengan hasil pemeriksaan dari pihak independen untuk memberikan pendapat atas karakteristik produk dan kecukupan pengamanan sistem Teknologi Informasi terkait produk serta kepatuhan terhadap ketentuan dan atau praktek-praktek yang berlaku di dunia internasional.

*Pengertian dari ayat 5 tersebut bahwa layanan E-Banking tersebut sebelum di launching harus dilakukan pemeriksaan / audit dari pihak independen. Jika mengacu ke SEBI 9/30/DPNP Sub BAB 8.6.1.1 untuk pengertian pihak independen yang dimaksud adalah:

Yang dimaksud dengan pihak independen adalah pihak-pihak yang tidak terlibat dalam perancangan dan pengembangan sistem aplikasi serta pengambilan keputusan untuk implementasi (go or no go).

Hasil pemeriksaan dari pihak independen di luar Bank (Kantor Akuntan Publik atau perusahaan konsultan dibidang IT Security atau sejenisnya) diperlukan untuk produk e-banking bersifat transaksional yang baru pertama kali diterbitkan oleh Bank seperti internet banking yang bersifat transaksional dan sms banking yang bersifat transaksional.

Untuk ruang lingkup pemeriksaandari pihak independen dapat mengacu ke SEBI 9/30/DPNP Sub BAB 8.6.1.2 untuk ruang lingkupnya adalah sebagai berikut:

Bank wajib memastikan bahwa laporan yang disampaikan oleh pihak independen mengenai kesiapan TI Bank untuk kegiatan e-banking yang direncanakan memuat periode pemeriksaan, ruang lingkup, metode pemeriksaan, temuan, rekomendasi, tanggapan manajemen atas temuan serta target penyelesaian. Adapun ruang lingkup pemeriksaan meliputi:

a. pengawasan aktif manajemen;

b. kecukupan kebijakan dan prosedur pengamanan sistem e-banking untuk memastikan terpenuhinya prinsip kerahasiaan, integritas, ketersediaan dan non repudiation dalam setiap transaksi e-banking;

c. kecukupan penerapan dan pemantauan terhadap pengamanan sistem aplikasi ebanking yang disiapkan bank yang meliputi:

1) penerapan pengamanan aplikasi, infrastruktur (server, firewall dan router) serta jaringan sistem e-banking;

2) pengamanan untuk mendeteksi transaksi yang tidak wajar;
3) terdapat pemeliharaan dan kaji ulang atas audit trail log transaksi;
4) pengamanan fisik yang memadai atas perangkat komputer dan perangkat komunikasi terkait produk/jasa e-banking;
5) pengamanan atas jaringan internal bank sehingga terlindung dari serangan yang berasal dari eksternal;
6) pengamanan atas data dan database transaksi e-banking.

d. Business Continuity Plan dan prosedur tanggap darurat (incident response management);

e. penggunaan pihak penyedia jasa TI sebagai penyelenggara e-banking;

f. kaji ulang atas analisis risiko dalam produk baru e-banking yang meliputi sekurang-kurangnya risiko strategis, risiko pengamanan, risiko hukum, risiko reputasi;

g. program edukasi dan perlindungan nasabah termasuk kehati-hatian dalam pembukaan rekening dan dalam melakukan transaksi melalui e-banking.

Jika syarat-syarat diatas telah dapat dipenuhi oleh Bank, maka dapat mengirimkan laporan dan semua dokumen pendukung kepada pihak Regulator. Jika pihak Regulator telah mengirimkan surat izin untuk penerbitan layanan E-Banking tersebut, maka Bank masih ada kewajiban yang harus dipenuhi yaitu merujuk ke 9/15/PBI/2007 pada ayat 7 yang menyebutkan:

Realisasi rencana penerbitan produk Electronic Banking wajib dilaporkan paling lambat 1 (satu) bulan sejak rencana dilaksanakan dengan menggunakan format Laporan Perubahan Mendasar Teknologi Informasi.

Dapat juga melihat secara detail isi di SEBI 9/30/DPNP Sub BAB 8.6 sebagai berikut:

Setiap rencana penerbitan produk Electronic Banking yang bersifat transaksional wajib dilaporkan kepada Bank Indonesia paling lambat 2 (dua) bulan sebelum produk tersebut diterbitkan dengan menggunakan Lampiran 2.21. Rencana Penerbitan Electronic Banking Transaksional. Ketentuan pelaporan rencana produk Electronic Banking berlaku untuk setiap produk baru yang karakteristiknya berbeda dengan produk yang telah ada di Bank dan/atau menambah atau meningkatkan eksposur risiko tertentu pada Bank. Ketentuan pelaporan ini tidak berlaku untuk produk Electronic Banking yang diatur secara khusus dalam ketentuan Bank Indonesia mengenai persyaratan persetujuan produk tersebut.

Dalam hal Teknologi Informasi yang digunakan dalam menyelenggarakan kegiatan Electronic Banking dilakukan oleh pihak penyedia jasa maka berlaku pula ketentuan penggunaan penyedia jasa sebagaimana diatur dalam Bab X mengenai Penggunaan Pihak Penyedia Jasa Teknologi Informasi.

Yang dimaksud dengan “produk Elektronik Banking baru” adalah produk baru yang karakteristiknya berbeda dengan produk yang telah ada di Bank dan/atau menambah atau meningkatkan eksposur risiko tertentu pada Bank, seperti internet banking dan phone banking untuk nasabah penyimpan.

Dengan demikian apabila Bank hanya menambah jenis layanan pada produk ebanking yang telah ada dan penambahan risikonya tidak signifikan misalnya penambahan fasilitas pembayaran melalui e-banking yang semula hanya melayani pembayaran kartu kredit menjadi pembayaran listrik atau telepon, maka penambahan layanan pembayaran tersebut tidak tergolong produk baru sehingga tidak perlu dilaporkan.

Namun jika Bank menambah layanan misalnya yang semula hanya menangani transaksi rupiah kemudian menambah layanan berupa transaksi valuta asing maka Bank harus melaporkan produk baru tersebut karena berdasarkan analisis risiko, transaksi tersebut dapat meningkatkan risiko pasar, risiko hukum, dan risiko lainnya.

Selanjutnya paling lambat 1 (satu) bulan sejak kegiatan tersebut efektif dioperasikan, Bank wajib melaporkan realisasi kegiatan sesuai format Laporan Perubahan Mendasar dalam Penggunaan Teknologi Informasi dengan menggunakan Lampiran 2.3.1. Realisasi Penerbitan Electronic Banking Transaksional. Laporan realisasi tersebut harus dilengkapi dengan tinjauan atas hasil implementasi (Post Implementation Review) oleh pihak independen. Produk dan/atau aktivitas baru yang telah dilaporkan dalam Laporan Realisasi Rencana Perubahan Mendasar Teknologi Informasi tidak perlu dilaporkan dalam Laporan Produk dan Aktivitas Baru sebagaimana diatur dalam ketentuan Bank Indonesia mengenai manajemen risiko Bank umum.

Jika pihak Bank tidak mengikuti seperti hal-hal diatas atau dengan kata lain langsung melakukan launching tanpa mendapatkan ijin dari Badan Regulator, akan dikenakan sanksi sesuai dengan 9/15/PBI/2007 Bab VIII dari Pasal 30 sampai 32 sebagai berikut:

Pasal 30 
Bank yang tidak melaksanakan ketentuan sebagaimana ditetapkan dalam Peraturan Bank Indonesia ini dan ketentuan pelaksanaan terkait lainnya dapat dikenakan sanksi administratif sebagaimana dimaksud dalam Pasal 52 Undang Undang Nomor 7 Tahun 1992 tentang Perbankan sebagaimana telah diubah dengan Undang Undang Nomor 10 Tahun 1998, antara lain berupa:
a. teguran tertulis;
b. penurunan tingkat kesehatan berupa penurunan peringkat faktor manajemen dalam penilaian tingkat kesehatan;
c. pembekuan kegiatan usaha tertentu;
d. pencantuman anggota pengurus dalam daftar tidak lulus melalui mekanisme uji kepatutan dan kelayakan (fit and proper test).

Pasal 31 
Bank yang tidak memenuhi ketentuan pelaporan sebagaimana dimaksud dalam Pasal 21 ayat (2), ayat (3) dan ayat (4), Pasal 23 ayat (2) dan ayat (7), Pasal 24 dan Pasal 25 Peraturan Bank Indonesia ini dikenakan sanksi sesuai Pasal 52 Undang Undang Nomor 7 Tahun 1992 tentang Perbankan sebagaimana diubah dengan Undang Undang Nomor 10 Tahun 1998, berupa:
a. kewajiban membayar sebesar Rp1.000.000,00 (satu juta rupiah) per hari keterlambatan per laporan;
b. kewajiban membayar sebesar Rp50.000.000,00 (lima puluh juta rupiah) per laporan, bagi Bank yang belum menyampaikan laporan setelah 1 (satu) bulan sejak batas akhir waktu penyampaian laporan.

Pasal 32 
Bank yang menyampaikan laporan yang tidak sesuai dengan kondisi Bank yang sebenarnya dikenakan sanksi kewajiban membayar sebesar Rp50.000.000,00 (lima puluh juta rupiah) setelah Bank diberikan 2 (dua) kali surat teguran oleh Bank Indonesia dengan tenggang waktu 7 (tujuh) hari kerja untuk setiap teguran dan Bank tidak memperbaiki laporan dalam jangka waktu 7 (tujuh) hari kerja setelah surat teguran terakhir.

Demikianlah tulisan saya ini dan jika terdapat kesalahan mohon dimaafkan. Apabila ada yang ingin berdiskusi bisa dengan meninggalkan komentar ditulisan ini dan kita saling sharing agar lebih dapat memahami peraturan yang berlaku di Indonesia tercinta ini.

Download:
9/15/PBI/2007
SEBI 9/30/DPNP dan Lampiran

Read More

Cara Cek Kelemahan MS08-067 Pada Windows XP Dengan NMAP

Selamat sore pemirsa, saya sedikit ingin membahas tentang kelemahan yang ada di sistem operasi windows XP. Masih banyak beberapa komputer yang sampai saat ini menggunakan sistem operasi yang sudah tidak didukung oleh Microsoft apabila terjadi bug atau vulnerability.

Saya akan mencoba membahas tentang celah keamanan yang paling sering digunakan oleh Attacker dalam memasuki windows XP tersebut dengan memanfaatkan celah "MS08-067". Saya tidak akan membahas detail tentang kelemahan tersebut, akan tetapi bagaimana kita melakukan deteksi terhadap kelemahan tersebut dibeberapa IP Target kita dengan menggunakan tools NMAP. Jika anda ingin membaca mendetail tentang MS08-067 dapat melihat link ini:

https://technet.microsoft.com/en-us/library/security/ms08-067.aspx

Jika anda mempunyai vuln scanner seperti Nexpose, Nessus, GFI, dkk pasti lebih mudah tinggal klak klik saja dan sambil ngupi nanti beberapa vuln akan tampil di report anda. Tanpa basa basi yuk langsung buka console agan dan saya disini menggunakan OS Kali Linux yang sudah include NMap dan Metasploit serta tools tercinta saya "Armitage" yang selalu memanjakan saya tanpa susah-susah ngetik manual code di metasploit dan sudah GUI yang berbasiskan Java.

Oh ya untuk fungsi NMap saya juga tidak bisa menjelaskan panjang lebar, yang jelas tools tersebut untuk melakukan scanning terhadap IP xyz untuk mendapatkan beberapa informasi seperti sistem operasi yang digunakan, port open, dll. Untuk logo NMap juga ga akan saya bahas yah karena serem mata satu seperti logo di akhir jaman.

Kembali ke tujuan utama, yaitu ingin melakukan pengecekan terhadap celah MS08-067 tersebut maka anda dapat mengetikkan di konsol anda dengan perintah:

root@kali:~# nmap --v --p 139,445 --script=smb--check-vulns --script-args=unsafe=1 IP Target

Seperti gambar diatas bahwa terdeteksi adanya kelemahan pada sistem operasi si IP Target tersebut dan kita dapat melanjutkan ke tahap exploit dengan Metasploit atau dengan Armitage (Jangan lupa nyalakan service postgresql dan metasploit di Kali Linux).

Keterangan:

LHOST = IP Kita sebagai kepo / listener

LPORT = Port kita untuk kepoin target

RHOST = IP si Target calon korban

RPORT = 445 atau 139

Jika sudah diisikan seperti contoh gambar diatas, maka anda tinggal klik tombol launch dan selamat menikmati santapan lezat anda yah. Tinggal berkreasi lebih baik lagi jika sudah mendapatkan akses meterpreter / shell.

Sumber:

http://nmap.org/nsedoc/scripts/smb-check-vulns.html

https://technet.microsoft.com/en-us/library/security/ms08-067.aspx

Haking Magazine

Offensive Security PWK dari Agan Kibort Kaskus

Read More

Hal-hal yang harus diperhatikan dalam penggunaan core banking web based

Wah sudah lama beberapa bulan ini tidak menulis di blogku. Beberapa minggu yang lalu ada beberapa vendor yang presentasi produk Core Banking System. Ketika saya mengikuti beberapa presentasi dari mereka, saya kaget juga jika sekarang beberapa aplikasi core sudah meninggalkan desktop application tapi sudah beralih ke web based application, maklum saya gagap teknologi.

Ada bagusnya jika menggunakan web application dikarenakan pihak client tidak perlu melakukan install application di komputer atau laptop mereka tapi tinggal memanggil url aplikasi tersebut. Banyak sekali manfaat aplikasi yang berbasiskan web dan anda dapat mencari di mbah Google. Akan tetapi jika aplikasi bersifat kritikal atau terkait dengan transaksi, ada beberapa hal-hal yang harus diperhatikan antara lain:

- Aplikasi harus menggunakan secure protocol seperti penggunaan "Https". Usahakan untuk penggunaan url bersifat unik dan alangkah baiknya bukan memanggil alamat IP tapi ke alamat seperti domain jaringan internal. Sebagai contoh "https://corebankingxyz"

- End user tidak boleh menggunakan fasilitas remember password pada browser.

- Satu akun hanya dapat diakses oleh satu browser atau dengan kata lain tidak boleh menggunakan multiple browser dengan waktu yang bersamaan. Misal jika sekarang saya lagi login di browser xyz maka saya coba juga di browser abc maka tidak bisa login secara bersamaan. Begitu juga dengan IP address-nya loh, atau dengan kata lain satu akun hanya bisa diakses oleh single browser dan single ip dalam waktu yang bersamaan. Best practice untuk desktop application juga seperti itu loh.

- URL application tidak boleh bersifat IP Publik yang dapat diakses oleh IP diluar jaringan internal perusahaan / organisasi. Jika ingin mengakses dari jaringan luar, harus menggunakan VPN yang terdaftar dan melewati firewall terlebih dahulu.

- Perusahaan harus menetapkan segmentasi jaringan komunikasi.

- Harus ada firewall yang berfungsi untuk IDS dan IPS.

- Jika menggunakan web services seperti apache, tomcat, iis, dll maka harus aware apabila ada update patch. Hal ini juga tidak hanya untuk web services loh kawan tapi juga patch di sistem operasi, dll.

- Hal yang menurut penting bagi saya adalah terus dilakukan security test yang dilakukan oleh pihak internal maupun eksternal, hal ini untuk mengetahui seberapa secure aplikasi dan infrastruktur yang digunakan.

- Poin terakhir adalah sering dilakukan sosialisasi tentang keamanan informasi dan prosedur terkait aplikasi tersebut.

Sekian tulisan saya ini dan mungkin masih jauh dari kesempurnaan.

Read More

General Penetration Testing Framework

Kali Linux is a versatile operating system that comes with a number of security assessment and penetration testing tools. Deriving and practicing these tools without a proper framework can lead to unsuccessful testing and might produce unsatisfied results. Thus, formalizing the security testing with a structured framework is extremely important from a technical and managerial perspective. 

The general testing framework presented in this section will constitute both the black box and white box approaches. It offers you a basic overview of the typical phases through which an auditor or penetration tester should progress. Either of these approaches can be adjusted according to the given target of assessment. The framework is composed of a number of steps that should be followed in a process at the initial, medial, and final stages of testing in order to accomplish a successful assessment. These include the following:

• Target scoping

• Information gathering

• Target discovery
• Enumerating target

• Vulnerability mapping

• Social engineering

• Target exploitation

• Privilege escalation
• Maintaining access
• Documentation and reporting

Whether applying any combination of these steps with the black box or white box approaches, it is left to the penetration tester to decide and choose the most strategic path according to the given target environment and its prior knowledge before the test begins. We will explain each stage of testing with a brief description, definition, and its possible applications. This general approach may be combined with any of the existing methodologies and should be used as a guideline rather than a penetration testing catch-all solution.

Target scoping

Before starting the technical security assessment, it is important to observe and understand the given scope of the target network environment. It is also necessary to know that the scope can be defined for a single entity or set of entities that are given to the auditor. The following list provides you with typical decisions that need to be made during the target scoping phase:

• What should be tested?

• How should it be tested?

• What conditions should be applied during the test process?

• What will limit the execution of the test process?

• How long will it take to complete the test?

• What business objectives will be achieved?

To lead a successful penetration testing, an auditor must be aware of the technology under assessment, its basic functionality, and its interaction with the network environment. Thus, the knowledge of an auditor does make a significant contribution towards any kind of security assessment.

Information gathering
Once the scope is finalized, it is time to move into the reconnaissance phase. During this phase, a pentester uses a number of publicly available resources to learn more about his or her target. This information can be retrieved from Internet sources such as:
• Forums
• Bulletin boards
• Newsgroups

• Articles
• Blogs
• Social networks
• Commercial or non-commercial websites

Additionally, the data can also be gathered through various search engines, such as Google, Yahoo!, MSN Bing, Baidu, and others. Moreover, an auditor can use the tools provided in Kali Linux to extract the network information about a target. These tools perform valuable data mining techniques to collect information through DNS servers, trace routes, Whois database, e-mail addresses, phone numbers, personal information, and user accounts. As more information is gathered, the probability of conducting a successful penetration test is increased.

Target discovery
This phase mainly deals with identifying the target's network status, operating system, and its relative network architecture. This provides you with a complete image of the interconnected current technologies or devices and may further help you in enumerating various services that are running over the network. By using the advanced network tools from Kali Linux, one can determine the live network hosts, operating systems running on these host machines, and characterize each device according to its role in the network system. These tools generally implement active and passive detection techniques on the top of network protocols, which can be manipulated in different forms to acquire useful information such as operating system fingerprinting.

Enumerating target
This phase takes all the previous efforts forward and finds the open ports on the target systems. Once the open ports have been identified, they can be enumerated for the running services. Using a number of port scanning techniques such as fullopen, half-open, and stealth scan can help determine the port's visibility even if the host is behind a firewall or Intrusion Detection System (IDS). The services mapped to the open ports help in further investigating the vulnerabilities that might exist in the target network's infrastructure. Hence, this phase serves as a base for finding vulnerabilities in various network devices, which can lead to a serious penetration. An auditor can use some automated tools given in Kali Linux to achieve the goal of this phase.

Vulnerability mapping
Up until the previous phase, we have gathered sufficient information about the target network. It is now time to identify and analyze the vulnerabilities based on the disclosed ports and services. This process can be achieved via a number of automated network and application vulnerability assessment tools that are present under the Kali Linux OS. It can also be done manually but takes an enormous amount of time and requires expert knowledge. However, combining both approaches should provide an auditor with a clear vision to carefully examine any known or unknown vulnerability that may otherwise exist on the network systems.

Social engineering
Practicing the art of deception is considerably important when there is no open gate available for an auditor to enter the target network. Thus, using a human attack vector, it is still possible to penetrate the target system by tricking a user into executing malicious code that should give backdoor access to the auditor. Social engineering comes in different forms. This can be anybody pretending to be a network administrator over the phone forcing you to reveal your account information or an e-mail phishing scam that can hijack your bank account details. Someone imitating personnel to get into a physical location is also considered social engineering. There is an immense set of possibilities that could be applied to achieve the required goal. Note that for a successful penetration, additional time to understand human psychology may be required before applying any suitable deception against the target. It is also important to fully understand the associated laws of your country with regards to social engineering prior to attempting this phase.

Target exploitation
After carefully examining the discovered vulnerabilities, it is possible to penetrate the target system based on the types of exploits that are available. Sometimes, it may require additional research or modifications to the existing exploit in order to make it work properly. This sounds a bit difficult but might get easier when considering a work under advanced exploitation tools, which are already provided with Kali Linux. Moreover, an auditor can also apply client-side exploitation methods mixed with a little social engineering to take control of a target system. Thus, this phase mainly focuses on the target acquisition process. The process coordinates three core areas, which involve pre-exploitation, exploitation, and post-exploitation activities.

Privilege escalation
Once the target is acquired, the penetration is successful. An auditor can now move freely into the system, depending on his or her access privileges. These privileges can also be escalated using any local exploits that match the system's environment, which, once executed, should help you attain super-user or system-level privileges. From this point of entry, an auditor might also be able to launch further attacks against the local network systems. This process can be restricted or non-restricted depending on the given target's scope. There is also a possibility of learning more about the compromised target by sniffing the network traffic, cracking passwords of various services, and applying local network spoofing tactics. Hence, the purpose of privilege escalation is to gain the highest-level access to the system that is possible.

Maintaining access
Sometimes, an auditor might be asked to retain access to the system for a specified time period. Such activity can be used to demonstrate illegitimate access to the system without performing the penetration testing process again. This saves time, cost, and resources that are being served to gain access to the system for security purposes. Employing some secret tunneling methods, which make a use of protocol, proxy, or end-to-end connection strategy that can lead to establishing a backdoor access, can help an auditor maintain his or her footsteps into the target system as long as required. This kind of system access provides you with a clear view on how an attacker can maintain his or her presence in the system without noisy behavior.

Documentation and reporting
Documenting, reporting, and presenting the vulnerabilities found, verified, and exploited will conclude your penetration testing activities. From an ethical perspective, this is extremely important because the concerned managerial and technical team can inspect the method of penetration and try to close any security loopholes that may exist. The types of reports that are created for each relevant authority in the contracting organization may have different outlooks to assist the business and technical staff understand and analyze the weak points that exist in their IT infrastructure. Additionally, these reports can serve the purpose of capturing and comparing the target system's integrity before and after the penetration process.

-Copy Paste-
^_^

Read More

Vulnerability Assessment vs Penetration Testing

There is always a need to understand and practice the correct terminology for security assessment. Throughout your career, you may run into commercial grade companies and non-commercial organizations that are likely to misinterpret the term penetration testing when trying to select an assessment type. It is important that you understand the differences between these types of tests.

Vulnerability assessment is a process to assess the internal and external security controls by identifying the threats that pose serious exposure to the organizations assets. This technical infrastructure evaluation not only points to the risks in the existing defenses, but also recommends and prioritizes the remediation strategies. The internal vulnerability assessment provides you with an assurance to secure the internal systems, while the external vulnerability assessment demonstrates the security of the perimeter defenses. In both testing criteria, each asset on the network is rigorously tested against multiple attack vectors to identify unattended threats and quantify the reactive measures. Depending on the type of assessment being carried out, a unique set of testing processes, tools, and techniques are followed to detect and identify vulnerabilities in the information assets in an automated fashion. This can be achieved using an integrated vulnerability management platform that
manages an up-to-date vulnerabilities database and is capable of testing different types of network devices while maintaining the integrity of configuration and change management.

A key difference between the vulnerability assessment and penetration testing is that the penetration testing goes beyond the level of identifying vulnerabilities and hooks into the process of exploitation, privilege escalation, and maintaining access to the target system(s). On the other hand, vulnerability assessment provides you with a broad view of any existing flaws in the system without measuring the impact of these flaws to the system under consideration. Another major difference between both of these terms is that the penetration testing is considerably more intrusive than the vulnerability assessment and aggressively applies all of the technical methods to exploit the live production environment. However, the vulnerability assessment process carefully identifies and quantifies all the known vulnerabilities in a non-invasive manner.

Why penetration testing?
When there is doubt that mitigating controls such as firewalls, intrusion detection systems, file integrity monitoring, and so on are effective, a full penetration test is ideal. Vulnerability scanning will locate individual vulnerabilities; however, penetration testing will actually attempt to verify that these vulnerabilities are exploitable within the target environment.

This perception, while dealing with both of these assessment types, might confuse and overlap the terms interchangeably, which is absolutely wrong. A qualified consultant always attempts to work out the best type of assessment based on the client's business requirement rather than misleading them from one over the other. It is also the duty of the contracting party to look into the core details of the selected security assessment program before taking any final decision.

Penetration testing is an expensive service in comparison to vulnerability assessment.

Read More

Penetration Testing Methodology

Penetration testing, often abbreviated as pentest, is a process that is followed to conduct an in-depth security assessment or audit. A methodology defines a set of rules, practices, and procedures that are pursued and implemented during the course of any information security audit program. A penetration testing methodology defines a roadmap with practical ideas and proven practices that can be followed to assess the true security posture of a network, application, system, or any combination thereof. This chapter offers summaries of several key penetration testing methodologies. Key topics covered in this chapter include:

• A discussion on two well-known types of penetration testing—black box and white box
• Describing the differences between the vulnerability assessment and penetration testing
• Explaining several industry-acceptable security testing methodologies and their core functions, features, and benefits
• A general penetration testing methodology that incorporates the 10 consecutive steps of a typical penetration testing process
• The ethical dimension of how the security testing projects should be handled 

Penetration testing can be carried out independently or as a part of an IT security risk management process that may be incorporated into a regular development life cycle (for example, Microsoft SDLC). It is vital to notice that the security of a product not only depends on the factors that are related to the IT environment but also relies on product-specific security best practices. This involves the implementation of appropriate security requirements, performing risk analysis, threat modeling, code reviews, and operational security measurement.

Penetration testing is considered to be the last and most aggressive form of security assessment. It must be handled by qualified professionals and can be conducted with or without prior knowledge of the targeted network or application. A pentest may be used to assess all IT infrastructure components including applications, network devices, operating systems, communication medium, physical security, and human psychology. The output of penetration testing usually consists of a report divided
into several sections that address the weaknesses found in the current state of the target environment, followed by potential countermeasures and other remediation recommendations. The use of a methodological process provides extensive benefits to the pentester to understand and critically analyze the integrity of current defenses during each stage of the testing process.

Types of penetration testing
Although there are different types of penetration testing, the two most general approaches that are widely accepted by the industry are the black box and white box. These approaches will be discussed in the following sections.

Black box testing
While applying this approach, the security auditor will be assessing the network infrastructure and will not be aware of any internal technologies deployed by the targeted organization. By employing a number of real-world hacker techniques and going through organized test phases, vulnerabilities may be revealed and potentially exploited. It is important for a pentester to understand, classify, and prioritize these vulnerabilities according to their level of risk (low, medium, or high). The risk can be
measured according to the threat imposed by the vulnerability in general. An ideal penetration tester would determine all attack vectors that could cause the target to be compromised. Once the testing process has been completed, a report that contains all the necessary information regarding the targets' real-world security posture, categorizing, and translating the identified risks into a business context, is generated. Black box testing can be a more expensive service than white box testing.

White box testing
An auditor involved in this kind of penetration testing process should be aware of all the internal and underlying technologies used by the target environment. Hence, it opens a wide gate for a penetration tester to view and critically evaluate the security vulnerabilities with minimum possible efforts and utmost accuracy. It does bring more value to the organization in comparison to the black box approach in the sense that it will eliminate any internal security issues lying at the target infrastructure's environment, thus making it more difficult for a malicious adversary to infiltrate from the outside. The number of steps involved in white box testing is similar to that of black box testing. Moreover, the white box approach can easily be integrated into a regular development life cycle to eradicate any possible security issues at an early stage before they get disclosed and exploited by intruders. The time, cost, and knowledge level required to find and resolve the security vulnerabilities is comparably less than with the black box approach.

Read More