4 ms·
During pentests most testers run the usual route of attacking the domain. In my opinion it's not realistic, because most attackers don't attack domains. They at
by netsec_burn 8y ago
During pentests most testers run the usual route of attacking the domain. In my opinion it's not realistic, because most attackers don't attack domains. They attack applications.
- bitexploder 8y agoTrue. Information security criticality migrated to applications a decade ago and never looked back. Internal networks are almost always easy to compromise. We have never failed on a 1000+ entity network. This implies, rather strongly, that you need to silo critical data and protect it at the application later, because the network is very hard for most organizations to secure.
- raesene9 8y agoThat is true but if you can get Domain Admin access, generally getting application access is pretty simple after that, and as getting DA is pretty simple if the domain hasn't been locked down (like the one in the post had), it's a reasonable place to go...
- bitexploder 8y agoThings like 2FA greatly limit the damage of a compromised domain and give defenders time to react.
- raesene9 8y agoI'm a great fan of 2FA for all administrative access. It's not a panacea for sure, but a definite good layer of defence
- flashman 8y agoIT Services mandated a pentest when we wanted to switch our corporate website to Drupal (as part of a battery of exercises intended to convince us to stay with Interwoven Teamsite, which they paid a million dollars a year for). When we agreed, they supplied an external penetration tester with the Drupal superuser password and said, "See? Unsafe!" when the pentester was able to log in and put the site into maintenance mode. I suppose in the strictest sense they were correct: trusting IT with credentials did turn out to be a security issue.