20 YEARS OF EXPERIENCE IN ITS SECURITY AUDITS

I was going to try to put together some chores about things that I learned after almost 20 years of experience in technical cyber security audits from my time in, among other things. FRA, the Swedish Armed Forces and now as self-employed.

The older I get, the more time I spend reflecting on and drawing conclusions on an overall and broader level.

It may not sound like important, but trying to estimate and prioritize the time you have allocated for the assignment is important. Not to spend too much time on things that can lead to a dead end.

Calculate time

Let the tools work for you and automate as much as you can, and in this way you can focus on things that require manual work, such as understanding an underlying logic in a system or software.

However, do not rely solely on automated tools but always verify and double check the results.

Communication

Establishing a good deliverable such as documentation (report) and being able to communicate this deliverable to your contractor is of great importance for success. You may be very capable technically but once the client receives your deliverable two weeks late, the value of your deliverable will decrease.

Do you know that you are less good at communicating and documenting but good at technology then make sure your team contains one or more people who can communicate or document.

Support functions and processes

Having good processes and routines as well as support functions that help you and elevate you in your work so that you can deliver according to your optimal ability is important. It may be that you do not have to go to boring meetings where you may have nothing to do or minimize time reporting. Or to avoid having to reinstall your own operating system, drivers or similar.

In your work, you can lean back to a good foundation when it comes to how assignments are received, allocated, prioritized and then delivered. And after completing the assignment how uncovering is done.

Internet access may not be available or should be used, so you or your colleagues need to think about what may be needed for offline use. I usually make sure to have many open source repos, indexed digital books (many publishers you can buy bulk cheaply) as well as deb packages available quickly.

Here you will find the shortcomings

My experience tells me that the security deficiencies are usually found in places like:

• Undocumented features / interfaces / APIs
• New or old code. Search for code that handles old file formats or protocols, for example
• Code that parses text or other complex functions
• Features that can be used in ways other than what the developer had intended
• Incorrect or inadequate separation between permissions or users
• Changes to the basic system. Most operating systems nowadays are relatively secure in their basic design, look for changes that have been implemented.
• Places where you can reach far into the system or code with external input

Of course there is a wealth of things I look at, maybe in a book in the future.

Traceability

Documenting your findings during your assignment is of great importance. Especially since you can probably find some kind of gold bar when you examine, for example, all http responses from the web server or all the network traffic that you have saved in pcap format.

The subsequent documentation will also be incredibly much easier if you save as much as possible. Also, screenshots or the like can also be useful as a complement to your ongoing text documentation (war diary) or raw data.

Also, do not forget that you must have a process to safely erase all information after completion of the assignment, if needed, part of your OPSEC.

Always think one step further

You might be quick to push a new exploit from Metasploit to a vulnerable server or client. But think about before this can have consequences in a second or third step and you need to make a case.

It may be that security monitoring (SOC) detects that you are conducting a Red Teaming operation and then you may need to change your IP address, mac address or similar. And then it is important to know how this goes before.

Other

I also always try to have the opportunity to do things in at least two different ways, it means that I can verify and double check certain things and if a tool or method fails I can always do it in some other way. Practice is also important so that you and your team or your tools and methods work when it is a sharp activity or assignment.

Also, make sure you can quickly and easily set up an environment that mimics the target system or software that you are reviewing. It allows you to find more shortcomings and not have to send all your tests over the network or similar.

Final words

Hope this can lead to you, your business or your team getting better at what you do in cybersecurity. Because I think it is important that we share our lessons and wisdom with each other and in this way we build more secure infrastructure, systems and software.

Also make sure to train your client so that he becomes a good customer, and help with requirements and expectations and conditions.