A penetration test is a method used to evaluate the security of a network system or computer system by stimulating an attack from people who are not authorized to use the system. Also, one can use people who have some level of access to simulate the attack. The process entails an active examination of the systems for any potential threats that could result from bad configuration of the system. It also checks for threats that could result from software and hardware flaws and operational limitations. The security problems that are identified when carrying out the attack are presented to the owner of the system. Effective test will provide the security problems; assess the impact of the problems on the organization. Also, it will outline various technical and procedural measures that can be implemented to reduce the threat. The penetration test should be conducted well to minimize the effect the test has on the production environments and ensure the back up systems and devices are not targeted.
High level methodology
An external method will used to test the network. The team members will be required to gather information from every device so as to understand the devices before carrying out the attack. The information gathered will be used to test the devices. Using the external method is important as it helps identify the vulnerability of the network devices and servers from the outside. The team will use different tools to gather information such as traceroute, ip2 country, Neotrace and Impact Pro’s Network Rapid Penetration tools (Ec- council, 2010).
penetration testing process
In this case, the DNS server, firewalls, mail servers, database servers and routers will be tested using internal and external teams. External testing will be conducted to determine whether the firewalls and routers are vulnerable. The external penetration testing will be carried from a computer system to determine if the internet barriers such as firewalls and routers can be exploited from the internet. The organization will be required to maintain its network configuration while the team tries to access the firewall and routers. The team will carry out an external scan to determine the level of susceptibility.
The firewall testing will be carried out sequentially via four different attack layers. The layers will be modeled after the observed attack patterns. The first layer will involve gathering of information so as to carry out deeper attacks in the other layers. The gathering of information will be non obtrusive. The second layer will involve intrusive collection of information. However, there will not be active attempts to penetrate the network. In the third layer, the team will try to penetrate the firewall and hosts within the network targeted from outside. In the final stage, the team will try to compromise the firewall security software, operating system and configuration from hosts within the company network (Ec- council, 2010).
Additionally, the team will attempt to penetrate the router from outside. The team will gather information about the routers that are found on the company network. The team will either use the Impact Pro’s Network Rapid Penetration Test to locate the routers and profile them. After gathering the information, the software will show the device as a potential target that can be attacked. Then the team will identify the manufacturer, model and operating systems information of the device. The team will determine the inputs on which the router gets connections and instructions and then test the device. The team will try to get the password and username for the device using the software. This will show that the device is vulnerable to hackers as someone can access the details of the router, change them and disrupt the network (Tiller, 2011).
The team will use different methods to test the database server. Database servers are not implemented in a secure manner because of the need for the servers to support web applications. The database server and web server are always communicating as employees are able to retrieved information from the database server by querying it from the internet. The web server and database server should be separated by a firewall to ensure they are secure. In order to test the database server, the team will try to access the server from the internet and retrieve information. A secure configuration of the servers will ensure traffic from the internet to the web server leaves over the HTTPs. Information from the database server will be transferred to the database protocol after the database is queried. This will ensure the web server cannot be used to access the database server without permission (Tiller, 2011).
Lastly, the team will try to test the DNS servers and mail servers. A DNS server is accessible from a public network. The mail server can be available on the public and private network. When testing the mail server, the team should determine whether it is on the private network or public network. The mail server on the public network is configured differently from a mail server on the private network. The mail server on the public network should connect to a different server on the network or receive information from the servers. The private server can send information to another server on the network. The team will use black box testing to test the DNS and mail server.
The team will gather information about the mail server and DNS server. They will identify the IP address of the server and names to be able to penetrate them. Then they will identify the traffic moving from one server to another. The team can use tracert and trace route for windows and UNIX environment respectively to determine the path that ICMP request follows when moving from one device to another in the network up to the destination. After determining the network and traffic, the team will alter the configuration for the DNS and mail servers so as to affect the network (Tiller, 2011).
Various tools will be used when testing the DNS, mail, web and database servers such as trace route. Trace routes is used to trace a packet as it moves from the computer to the internet host. It shows the number of hops and time a packet takes to move from the computer to the host. Also, the team will use the Neo Trace to gather information about the internet site. It is used to identify computers that are found on the internet by entering the IP address, URL and email address of the computers. The output provided by the tool will show the route between the user and the site and intermediate nodes. In addition, the team will use ip2 country to change the IP address into a country name if necessary (Tiller, 2011).
Timeline and reporting method
The penetration test will take one week. The team members will work within the time stated and provide information gathered after carrying out the test. The team will report any incidents identified in the environment by preparing a penetration report. The penetration report will show the risks identified and the recommendations or solutions to reduce the risk. The report will include all the tools and attacks used as stated above. The team members will include the results of each attack (Ec- council, 2010).
In conclusion, the penetration test will enable the organization make the necessary changes. The penetration test will identify vulnerability in the network and how they affect the company network. The company will implement the solutions identified by the team to prevent any attacks in future and enhance the operation of the organization.
Ec- council. (2010). Penetration Testing: Security Analysis. Cengage learning
Tiller, J.S. (2011). Ciso's Guide to Penetration Testing: A Framework to Plan, Manage, and Maximize Benefits. CRC press