4 ms·

I am biased here, but that isn't really fair if the person performing the penetration test is any good. Speaking strictly of external/internal penetration tests

I am biased here, but that isn't really fair if the person performing the penetration test is any good. Speaking strictly of external/internal penetration tests here, an average penetration tester, the kind you are referencing, will smash around for a bit, find one path to domain admin / service accounts on your Unix-likes and call it a day. Write a report and say, "yeah, you got pwned". A good penetration tester will look around a bit with their elevated privileges and maybe find some other things and write those up too. A great penetration tester will own everything, document how they did it initially, use their elevated access to gain an advanced understanding of your environment, document this understanding, and find as many nooks and crannies as they can in their assessment time frame. They will document these issues realistically and label things like auditing and clearing bash_history as defense in depth. But the parent also has a point. These little things are accelerators on a pen test. No they aren't going to be the thing that gets you owned. To be fair I have seen plenty of pen testers that wield findings like this as a hammer making it seem very important while missing the forest (for the tree in front of them) so to speak. Also, the best question probably isn't "did we get hacked?" but "how badly are we hacked right now?", because you are certainly "hacked", just maybe not at a nuclear melt down level.

freehunter 9y ago
Yeah, you stated my intent better than I did. Most pentesters I've worked with would show a bash history and say "look, you failed, fix these" and my client would get mad at me for not securing this even though this isn't what would get you hacked. It's like a home security company recommending you keep your cell phone in a locked safe at night instead of on your nightstand. Sure it's safer, but it's really inconvenient and a good home security system would notice the robber kick down your door before your phone even gets stolen. The idea of any security system should be to compliment normal business operations, not to hinder them.

freehunter 9y ago

Yeah, you stated my intent better than I did. Most pentesters I've worked with would show a bash history and say "look, you failed, fix these" and my client would get mad at me for not securing this even though this isn't what would get you hacked. It's like a home security company recommending you keep your cell phone in a locked safe at night instead of on your nightstand. Sure it's safer, but it's really inconvenient and a good home security system would notice the robber kick down your door before your phone even gets stolen. The idea of any security system should be to compliment normal business operations, not to hinder them.