When you think of the world of cyber and information security, what do you see? Is it a someone in a dark room, wearing a black hooded top, hunched over a computer with Matrix-style green code on the screen?
Or, is it an office cleaner, wheeling a trolley full of sprays and cloths around desks as they scout a business – or someone who appears to be a health and safety inspector sneaking onto workers' computers to gather sensitive information?
If you'd pictured the first scene, you're not alone. That's how the world at large tends to view cyber crime – and of course, much cyber crime is conducted by people sitting in front of computers.
But if you'd pictured the second, then you'd be looking beyond that to the real lengths such criminals go to when trying to hack into organisations. And you’d also be picturing one of the unexpected and unique ways we at Wavenet can help your own company protect itself from devastating and costly attacks on its data.
It's all part of our penetration testing service, and our Ethical Hacker and Principal Consultant, Rob Shapland explains more in this blog.
Pen Testing: a reminder of what it's about
Those of you who already work in IT will be more than familiar with the concept of pen testing. But for those of you who have the often tricky job of convincing colleagues outside of the IT department about the importance of information security, it's worth revisiting the concept – especially if you’re reading this with the view to sharing it on.
Short for 'penetration testing', pen testing is the practice of planning and running pre-approved mock attacks on an organisation to identify and exploit its vulnerabilities. As it’s usually offered by companies that work in IT, the term tends to be associated with cyber security and technology, but for Wavenet, it's much more than that.
“Pen testing is attempting to test the security of a system,” explains Rob. “It could be a company website, by running a suite of tests against that website – tests against that website that simulates the holes that a hacker would be looking for.
“Or it could be testing a company’s infrastructure – most companies will have a number of IP addresses that are pointed to the internet and you’d test those for potential vulnerabilities like out of date VPNs, or by attempting to get into the infrastructure through weak passwords.”
That, says Rob, is why pen testing tends to be viewed in terms of technology, rather than testing a company’s security more widely as we do at Wavenet. It’s also worth noting, adds Rob, that’s there’s a difference between pen testing and vulnerability scanning.
“With pen testing, if you find a vulnerability you're supposed to attempt to exploit it with the client’s permission, and so for example, if we discover an out of date VPN that's got a known vulnerability, we’ll gain access to see if there are any further vulnerabilities.
“With vulnerability scanning, clients may not want to go any further than that as there can be concerns about things ‘breaking’. So in practice, a lot of pen testing now is glorified vulnerability scanning.”
To really test your organisation's security means going beyond technology
Clearly, so much pen testing – effectively, a form of ethical hacking – focuses on technology, so it makes sense that it so often conjures up images of people in darkened rooms looking at code. But to understand how pen testing can be so much more valuable than that – and why Wavenet’s approach is different – it’s worth thinking about the 2014 British blockbuster film, Paddington.
A children’s film is not the kind of thing you’ll often hear IT companies referring to in terms of your organisation’s security, but it’s relevant. In the film, the titular character and his adopted guardian, Mr Brown, sneaks into the Geographer’s Guild to locate and steal some archived records, having first done their homework about the place.
For their attack, Mr Brown himself is dressed as a female cleaner to get past a security guard, and – as is typical of Paddington – a hilarious disaster involving marmalade sandwiches ensues. Obviously, we we’re not going to clog up your systems with bread-based snacks, but Paddington and Mr Brown’s cunning plan is not a million miles away from Rob’s work.
“One of the things we do with our pen testing is red teaming,” explains Rob. “With our client’s prior approval, we’ll attempt to breach a company’s entire security rather than just focusing on one system.
“To give you an example: a supermarket client might want to test the security of its rewards points database. So our brief would be to break into it and obtain customer data from it. And that’s where we’ll have to adopt the mindset of a criminal.”
While Rob does not have a Peruvian bear to assist him, he does have a team of equally friendly experts who know how to get under the skin and into the heart of an organisation – and it starts with what’s called open source intelligence gathering.
“That’s basically a term for conducting research on the internet,” explains Rob. “So with our supermarket client, we’ll start looking at how many systems they have online – how many websites they have – where’s their head office – could we break into their head office – who works there and so on.”
“We’ll look at their social media – they tend to be run by marketing teams and often post company photos with revealing information, like employee details on lanyards, which we can then use to create our own employee lanyards. If they use online recruitment platforms, we can find out about vacancies in the IT department, what systems they want applicants to have experience using, and therefore potential vulnerabilities.”
When you think about it, says Rob, there’s an enormous amount of information you can find out about a company online. And then, at Wavenet, we’ll go further than that.
“We’ll look at employees with distinctive names and then find their own social media profiles. Have they posted any photos on their Instagram about work events? Are they going away with work and likely to use different systems? Have they recently stayed at a hotel that we could use for creating a phishing attack, where we pretend to be the hotel contacting them to say they’ve left behind some property and asking them to open up a “photo”.
If this all sounds scary, it’s because it should sound scary. But it’s also because Rob and his team come from one of the first pen testing companies in the UK, so they have heaps of experience of putting themselves in the shoes of hackers.
“With ‘regular’ pen testing, you’re largely sticking to the technical side,” says Rob. “But with red teaming, you’re bringing the human side into it – the social engineering aspect. For us, it starts there.”
Planning the attack on your organisation
Next, having gathered their intelligence, Rob and colleagues will develop a custom plan of attack. They’ll decide whether they’re going to use a mock phishing attack, or make a phone call to convince an employee to hand over a password – including writing a script that’s tailor-made to the employee. Or even if they’re going to physically enter the organisation’s premises.
“Getting into a company’s offices involves scouting the location,” says Rob. “I’ll typically go there a week or two before the planned attack and observe the building – employees coming and going – what suppliers they have visiting – do they have people visiting to top up the vending machine and so on – and can I pose as one.
“Often I’ll just pretend to be an employee – I’ll even dress to match the workplace dress code – and tailgate a real employee. With a fake ID badge and a confident attitude, it’s not difficult to get past security at the front entrance, especially in big organisations where it’s impossible to know everyone.”
Depending on how you look at it, Rob’s work has revealed something about human nature that’s both reassuring and concerning.
“People are more trusting and helpful than often we realise,” says Rob. “Obviously, it’s lovely that we have a habit of things like holding doors open for people and assuming everyone’s operating in good faith – it would be a really cynical, cold world if we all thought otherwise. But from a security perspective, it does demonstrate why we so often say that people are a company’s greatest vulnerability. It’s sad fact of life, but it’s true.”
Having scoped everything needed to decide on the best course of action, Rob and his team can then proceed to the attack, before reporting back all the findings to the client.
Attacking your organisation
Long before the attack itself, Rob and his team would have agreed with the client a brief – the intended goal of the pen testing. So when reporting back to the client, the focus is to answer the brief.
“One of my past briefs was to first get inside the company office,” says Rob. “From there I had to steal some paperwork, then get into their server room – one of the places in an office where the most sensitive data is stored.
“Then I had to plug a USB stick into one of their laptops to prove I could have put viruses on there, and the last one was to get onto an unattended computer to send an internal email to our client.”
Rob achieved all the objectives and notably, with such a set of goals, it’s not unusual for him to change the pretext throughout the whole attack. He might start out as an employee to get past reception, then change into a contractor once inside, then back to an employee. Again, this all hinges on good planning – and creating credible personas: for example, an outside contractor is not going to know their way round the office so might ask for directions, while an employee is going to be much more at ease walking around. Like Mr Brown with Paddington, Rob has to do a certain amount of acting, using scripts prepared ahead of the attack.
“If we don’t plan everything in great detail in advance and we’re caught out, it will be a waste of time and a waste of our client’s money,” says Rob. “So we have to get it right. We have to think outside the box to make sure we’re as believable as possible.
Rob continues, “And yes, that means thinking like a hacker – for Wavenet’s pen testing, we have a uniquely creative side.”
Reporting back to you
Once the attack is completed and all objectives fulfilled, Rob and his team get onto reporting back to you – and that will be a written document with all the findings. But again, going further to bring the human aspect into this is a key differentiator for Wavenet.
“We’ll present the report to staff,” says Rob. “It’s no point just handing over a document and saying ‘here, read that’. If you’ve gone to all the trouble to put yourself through our pen testing, it makes no sense to not discuss it face to face, so we can answer questions then and there. This helps reassure or enthuse staff who might be shocked at the findings, or still need further convincing about the importance of information security.”
Such presentations for clients invariably lead to staff training, so building a good relationship with all interested parties – whether inside or outside the IT department – is a key benefit of the sessions.
“We often wear hidden cameras during the attack,” explains Rob. “So in our presentation, we’ll show the footage and it’s not uncommon for staff to be gobsmacked. A written report doesn’t really elicit the same response – and yes, a little bit of shock like this can really help overhaul a company’s culture when it comes to information security.”
The other benefit of the face-to-face presentation is that it’s entirely tailored to the client. Rob and his team’s reports may follow a methodical format, but they’re anything but cookie cutter in their approach.
“When you show an employee how a phishing attack specifically targeted them,” says Rob, “it’s not something they can forget in a hurry. It can also in a way be upsetting, so it’s vital we’re there to say ‘look, it’s ok – we did this to make sure this doesn’t happen for real with devastating consequences.
“We pride ourselves on being constructive, uplifting and friendly – one way we do this is to not talk in technical jargon – so while the reporting back can raise eyebrows, we’re there to make sure there’s smiles on faces, too.”
Beyond Pen Testing
After planning, conducting and reporting on the attack, many clients sign up for Wavenet’s security training. And because it all stems from the attack, the training isn’t theoretical or abstract – so with Wavenet, the training is genuinely engaging and very much money well spent.
“I’ve done a lot of work in the media,” says Rob. “I see being a good communicator as vital to my role – and to all my team members – so I’d like to think we’re experienced in making what can be a dry subject interesting and memorable.
“Obviously, there’s a lot here that we absolutely can’t talk about in the public domain, but to get a general feel for how I and my colleagues work, you can Google my name plus ‘ethical hacker’ and see some of our work in action.”
One such example is Rob’s work on the Channel 4 show, ‘Joe Lycett’s Got Your Back’, which you can see here.
And if you’d like to get the ball rolling with pen testing for your own organisation, you can get in touch with Rob and his team through our ‘contact us’ page, here. You won’t find a bunch of hackers in dark rooms – nor will you find any marmalade sandwiches – but you will find a team that’s both ingenious and affable.
