Featured
Penetration Test Proposal
What to expect from a penetration test or security assessment proposal from 2nd Sight Lab
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Check out my series on Automating Cybersecurity Metrics. The Code.
🔒 Related Stories: Pentesting | AppSec | Secure Code | Data Breaches
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I didn’t get a chance to do much coding or writing this week because suddenly I had to put out a lot of proposals all at once. I was especially happy that some former clients wanted to hire me again. It is a special honor to know someone appreciates your work that much that they want to hire you again.
A penetration test proposal
As I was writing proposals for clients I noticed I had created some proposals in different ways in the past. I sometimes write documents and sometimes slide decks. I don’t remember why I do this differently in some cases, but if I provided one or the other for a client in the past I tend to stick with that format.
I am going to share my slide deck proposal in this story with the blanks I would fill in if you request a proposal from me. If you like it, you can reach out to me on LinkedIn to get a proposal for your next penetration test. A proposal for a security assessment would be very similar. I send the proposal and the contract together. The contract must be signed by a C-Level executive.
Why am I sharing this? Because my proposal process is really straightforward and it makes it easy I hope for people to decide whether they want to hire 2nd Sight Lab or not. I don’t have a lot of variation in my proposals at the moment. This could change depending on how busy I am and how my 2nd Sight Lab services change in the future. So this is a snapshot of a proposal at this moment in time.
I explain the process we use for determining the scope and cost of a penetration test on the 2nd Sight Lab site:
https://2ndsightlab.com/pentesting.html
I spend very little time trying to close sales because first of all I’m busy. So are my clients. The other thing is I would rather spend more time on testing and providing value than writing lengthy proposal documents.
Secondly, I have found over the years that spending a ton of time on a proposal doesn’t increase or decrease the likelihood it will be signed. Here is what I have learned:
- Either people want my services as I offer them or they don’t.
- My price is within their budget or it’s not.
- They like my qualifications or they don’t.
- They like my approach or they do not.
I try to present the information for them as succinctly and quickly as possible so they can make a decision. I limit time going back and forth by providing everything a customer needs to make a decision at one time — the proposal and the contract — rather than sending a lot of emails back and forth. I can easily adjust the proposal if needed after that point.
I’ll share my slide deck with you but first, let’s clarify one thing.
A penetration test is not a vulnerability scan
A penetration test or a security assessment is not simply a vulnerability scan where, if I still did them, I would run a tool, it generates some information, and I hand it over. Some people try to pass off that kind of scan as a penetration test.
Some auditors may accept that, but others will not if you are trying to obtain compliance. I talked to a company whose auditor rejected their scan report trying to pass as a penetration test when they were trying to get a SOC 2. Some less experienced auditors may not know the difference.
Now I just include network, application, and cloud vulnerability scans as part of our penetration tests. Be we also go a lot deeper than that with reverse-engineering, attack path mapping (on AWS) and manual testing. For example, here are some of the things we would test for an application that uses OAuth and JWTs:
We also perform fuzzing with various types of encoding. I was pondering how to explore encoding further here:
Automation can be used to produce a good report — faster
Although a vulnerability scan is not a penetration test, on the flip side a generated report doesn’t mean it’s not a pentest either. This is where some old-school penetration testers like to point fingers and say any automation whatsoever is bad. That’s not true.
Because I have a background in software engineering I automate some of the things I do repeatedly on every single penetration test report. There’s no sense in me re-writing the same information over and over again or spending a million hours on formatting a document when I could be spending more time reverse engineering and manually testing systems for logic errors.
If you look at my report it may seem automated at first, and it partially is. I automate generation of the initial findings and layout. Then I go through and try to validate each finding, dive deeper, and I remove findings that are false positives. I add steps to reproduce critical findings with manual screen shots and explanations where applicable. I manually review as many findings as possible. I insert manual test findings into my data — and regenerate the report.
If I didn’t have enough time to review every single finding, I don’t exclude it from the report. I note which findings need time to review. I also note where I couldn’t prove something was exploitable but I think it is and why. In addition, I include non-security bugs in the appendix — caused by entry of malformed data or other things I did while testing.
Get Teri Radichel’s stories in your inbox
Join Medium for free to get updates from this writer.
Automation speeds up the busy work so I have more time for the complicated work of trying to exploit, explain, reproduce with specific steps, or eliminate findings that don’t matter.
I also combine the results of multiple tools, including some I’ve written myself, and findings discovered through manual testing and reverse-engineering.
So if someone looks at the report and says, “It’s automated so it’s bad” — then they really don’t understand what the findings mean. If they did, they would understand that the information was not all created by some scanning tool.
I had intended to cover that in my talk at RSA this year. However my talk was only selected as an alternate this year and now I can’t go as I’m too busy. I might produce a video on it anyway as I think there are some misconceptions in this area. Automation is not bad. Automation without any form of manual effort and verification is not a very good penetration test.
A penetration test proposal
To show the difference, I’ll share a simple penetration test proposal — for customers who are OK with this format. I can provide this in a document format instead of a slide deck if required.
As you can see from this proposal I’m doing a lot more than what is described as a vulnerability scan. I was fiddling with this and I’m in a hurry so I need to re-check it for any spelling or formatting errors. Just wanted to get it out there.
Note that the main thing 2nd Sight Lab brings to the table is experience reverse engineering and securing systems for 25 plus years. We specialize in web applications, APIs, SAAS applications, and cloud environments and especially AWS. Teri Radichel is an AWS Security Hero and has a GSE, master of software engineering and master of information security engineering.
She also has worked as a telecom analyst, run an e-commerce company managing servers in a data center, developed back office systems for an investment bank with billions of dollars of assets under management, managed cloud networking for one of the largest banks in the US and helped a security vendor migrate a firewall product to the cloud.
This experience is the core part of our proposal and why customers might want to hire 2nd Sight Lab and doesn’t change too much.
The main thing I would edit in my proposal are the specific client objectives and the scope of the project based on a worksheet I send to the client. Based on the number of resources and authentication methods to be tested, we recommend a timeframe and price. We can modify the timeframe and price within certain boundaries as needed.
If this proposal interests you and you would like a penetration test, please reach out on LinkedIn using the link below. Note that we only perform penetration tests for US countries at this time with a few exceptions for people I know personally. If you would like a longer document style proposal I can do that too. I’m getting pretty busy this year already so if you want to get on my schedule sooner is better than later.
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2024
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight LabNeed Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for PresentationFollow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
