Securing Exploits and Vulnerabilities: Ethical Hacking - Essay Example

Ethical Hacking: Executive Proposal Number Overview Advanced Research recognizes the significance of testing its security architecture for exploits and vulnerabilities before attackers take advantage of them and cause serious losses. Acting on my mandate as an IT manager tasked with security of physical and operational aspects, I present a security testing software that if adopted will benefit the organizations corporate information systems. The security testing software presented in this proposal is referred developed by Rapid7- a security management company. It presents a package of software solutions including Nexpose, Metasploit, Mobilisafe, ControlsInsight and UserInsight. The subject of this proposal is Metasploit security tool’s penetration testing which include password attacks, authentication bypass and operating system security among others. Description of the software and benefits Recognizing the organization’s need to test its defense more accurately, Rapid7 developed a suite of testing tools for every environment. Metasploit is presented as an attacker’s playbook backed by hundreds of thousands of users and contributors. It is penetration testing software that offers organizations insight on their security aspects including weak points and vulnerabilities before a malicious attacker does. Skilled penetration testers with capabilities to simulate attacks on the network and unearth security issues are hard to come by in an organization. For the few such as IT professionals and security experts, much of their tasks is spent on repetitive tasks and script customization, consequently taking little time to address the core problem of identifying security issues and advising accordingly (Maynor, 2008). Metasploit Pro is an advanced penetration analyzer that aid testers in conducting security assessments by leveraging discovery, exploitation, brute-forcing and reporting tools. The end result is the development of an advanced evasion and post-exploitation technique as well as better management of vast amounts of data sourced from the assessments. The software is easy to use even for security professionals new to penetrating testing procedures. Penetration testing conducted using this tool is not only efficient but also fast and is proven to increase productivity by 45%. Second, the tool is used to validate vulnerabilities and exploits in order to define an effective remediation strategy. Most vulnerability scanners can determine installed applications and their vulnerabilities but lack the intelligence to determine the exact risk to the organizations network (Ari Takanen, 2008). This is challenging because security experts would not know which vulnerability to remedy first. Metasploit Pro closes the gap in vulnerability testing by presenting the risk in an objective way and through collaboration with Nexpose - a vulnerability management solution with the capability to tell the “who, what and where” of the risk, remediation programs can be prioritized (Rapid7, 2014). Third, Metasploit is used to manage phishing and protect employee credentials. It is recognized that phishing is the third most popular attack vector in a company. There is always a grey area when it comes to an organization measuring and managing phishing exposure and gauging the effectiveness applicable training and technical controls. Metasploit gauges the effectiveness of a security program by conducting simulated phishing crusades to control exposure to phishing attacks. Product reviews, case studies and customer recommendations Metasploit has been tested in a variety of fields, and it is found to be effective. The President of Offensive Security Jim O’Gorman attributed the use of the application to time savings and fewer interruptions in organizational activities. According to him “,Time savings is our prime motivation for using Metasploit Pro (Rapid7, 2014).”Another security consultant, Ben Holder of Lumenate termed Metasploit as a useful software for delivering closed-loop vulnerability reports that facilitate the development of remediation activities. According to Holder, discovery of vulnerabilities is simplified by 70-80% by using Rapid7 products. With respect to phishing capabilities, Metasploit is a great business driver. Tim Pospisil, an IT Security Supervisor at Nebraska Public Power District, commented “What really facilitate our move to the top were the phishing provisions of Metasploit ... According to me, that was a critical business drive. (Rapid7, 2014)” during an interview. Personal experiences with Metasploit Having installed the free 14-day trial edition of Metaploit Pro, I realized that the software is far much beneficial than thought. The first feature that was beneficial in my case is the ability to test the network for weak and reused passwords from multiple accounts. This feature is really important in that security professional can detect common employee sources of password cracking synonymous with many organizations. In addition to cracking the operating system accounts, Metasploit Pro can initiate brute force attacks on multiple accounts such as databases, web servers, email accounts and remote administration accounts. This software is advanced in evading detection by common anti-malware solutions. This is especially one of the features that will eliminate the false positives offered by many software packages. With the dynamic payloads, it can evade anti-malware solutions 90% of the time. The ability to get past firewall and IPS using traffic-level evasion procedures can imitate the actions of dedicated attackers and help an organization develop an advanced security boundary. With all the capabilities mentioned, the best experience was on reporting. After penetrating the network undetected, Metasploit can effectively report on the findings from the network and application-layer perspective. I managed to generate reports of network bypass in a few steps rather than the tedious process of copying and pasting results at every stage. Report writing is the most frustrating part of any security analysis in addition to the time taken to compile all the particulars. The automated reports save up to a third of the assessment time, and this is valuable for any manager or security professional. Cost considerations Metasploit is available in four editions: Pro version for advanced penetration tests and enterprise security program, express edition for baseline penetration tests, community edition available free of charge for entry level and framework edition, a free open source developmental platform. Pro edition is offered on a 14-day trial upon which the user obtain a full license. Pro edition is the ultimate software that comes with advanced capabilities including dynamic payloads to circumvent leading antivirus packages, full access to internal networks via a compromised machine with VPN pivoting, closed-loop validation of vulnerabilities and remedy prioritization and phishing awareness and management among others. The express edition contains fewer capabilities as compared to the Pro version that includes smart exploitation, automated credential brute forcing and baseline penetration testing reports. The cost of the full-featured Pro edition is $15,000 per year for every user. That of the community edition is much cheaper going for $3,000 per user per year (David Kennedy, 2011). Additional costs include that for training on software deployment, administration and operational expertise. Training is intended for different types of security personnel such as certified administrators and specialists and costs a flat rate of $2,000. Webinars are regularly offered and free of charge. Training takes place every month at different locations in Americas, EMEA and APAC and all information is located at the company’s website http://www.rapid7.com/services/training-certification/product-training.jsp. System requirements Metasploit’s system requirements are not superior - the application can run on a system with 2GHz+ processor, 2GB RAM and 1GB of hard disk even though 50 GB of hard disk is recommended. For browsers, it requires Mozilla Firefox 18.0+, Microsoft Internet Explorer 9+, Google Chrome 10+ and Iceweasal 18+ (David Kennedy, 2011). The software can run on a varied OS’s including Windows Vista, 7, 8 and from Server 2003 and above, Red Hat Enterprise Linux 5, Ubuntu Linux 10 and Kali Linux 1.0 (David Kennedy, 2011). Effects of the software on the production environment Rapid7 has an always available customer support to offer product auto-updates, testing guarantees and round the clock Vulnerability SLA (Rapid7, 2014). All this services improves the operational environment of an organization by ensuring that production is not impacted in a major way. Rapid7 has a comprehensive database of vulnerabilities amounting to hundreds of thousands, and this is used as a benchmark for all users in establishing their own. Licensed holders will get due attention in solving any problem that comes up in the course of deployment, configuration and use. Thus, other than the normal installation interruptions, the software has no reported difficulties in the course of its use. Conclusion I propose Metasploit as the organization’s information systems security tester. This software solution provides advanced capabilities that will unearth security issues and vulnerabilities little known in Advanced Research. With the current security standing and the strategic position the company occupies in medical research and development, nothing should leave to chance and the only way to do this is by adopting Metasploit. References Ari Takanen, J. D. (2008). Fuzzing for Software Security Testing and Quality Assurance. Artech House. David Kennedy, J. O. (2011). Metasploit: The Penetration Testers Guide. No Starch Press. Maynor, D. (2008). Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research. Elsevier. Rapid7. (2014, September 24). Metasploit: Penetration Testing Software. Retrieved from rAPID7: http://www.rapid7.com/products/metasploit/capabilities.jsp Read More