Killing the Pen Test & BSides Knoxville (with Adrian Sanabria)

Advanced Persistent Security

Killing the Pen Test & BSides Knoxville (with Adrian Sanabria)

Advanced Persistent Security Podcast

Episode 44

Guests: Adrian Sanabria

April 26, 2018

If you enjoy this podcast, be sure to give us a 5 Star Review and “Love Us” on iTunes; Like us on Google Play, Stitcher, Sound Cloud, Spreaker, and YouTube.

NOTE: The opinions expressed in this podcast are ours alone and do not reflect those of our employers

Killing the Pen Test & BSides Knoxville (with Adrian Sanabria)

Show Notes

In this episode, Joe is joined by Adrian Sanabria. Adrian is a co-organizer of BSides Knoxville and one of the founders of dc865. We discuss Adrian’s background in technology and how he came into security in the days before PCI. Adrian talks about his transition into working at 451 Research in terms of terminology and industry analysis.

Joe and Adrian talk about Savage Security and RSA Conference. Adrian tells us about his (then forthcoming) presentation at RSA Conference. Adrian’s presentation is called It is Time to Kill the Pen Test and why it is important. He cites Haroon Meer’s Keynote at 44con in 2011 as a thought provoking idea that spawned this.

Pen testing as a skill is not the problem, it is the service offering that is. Adrian cites inefficiencies like vulnerability scanning and reporting at the same rate as the test. We talk about the advanced attacks versus sticking to the basics. Adrian talks about prioritizing breach simulations and ransomware simulations over a pen test.

We talk about the scoping documents of pen tests and how they are relative to actual attacks and their objectives. The fact that not all adversaries attempt to get domain admin, while others try to perform defacement or exfiltration. Adrian mentions Haroon’s quote:

Pen testers are not emulating attackers. They are emulating other pen testers.

Adrian talks about the lack of responsiveness of blue teams during pen tests. We talk about the mentality of many attackers of wanting to “pwn the world” vice enhance the security of an organization. Adrian calls for more “white box testing.” Joe mentions the lack of analysis of OSINT as another inefficiency in pen testing. We also discuss the fact that dwell time is so high that expecting a black box test is almost unrealistic.

Adrian talks about some metrics associated with MSSPs detecting him when doing breach simulations. We talk about C2 and other indicators such as the use of TOR. We talk about how to make the industry better.

About Adrian:

Adrian Sanabria is Co-Founder and Director of Research at Savage Security. Sanabria’s past experience includes 13 years as a Defender and Consultant building security programs, defending large financial organizations and performing penetration tests. He has spent far more time dealing with PCI than is healthy for an adult male of his age. Sanabria learned the business side of the industry as a research analyst for 451 Research, working closely with vendors and investors. He is an outspoken researcher and doesn’t shy away from the truth or being proven wrong. Sanabria loves to write about the industry, tell stories and still sees the glass as half full.

Contacting Adrian:

Twitter: @sawaba
Blog

BSides Knoxville:

Website
Registration
Date: May 18, 2018
Locations: Scruffy City Hall, Preservation Pub, Knoxville Entrepreneurial Center
8:00 AM – 6:00 PM

Thanks for stopping by and checking out our podcast. We would appreciate if you could subscribe (assuming you like what you hear; we think you will). This is meant to be informative and to provide value to anyone who listens – regardless of their knowledge and/or understanding of IT/Cybersecurity. To learn more about us, check out our “About Us” page.

Enter your email address:
Delivered by FeedBurner

SUBSCRIBE TO OUR MAILING LIST

* indicates required

Email Address *

First Name

Last Name