El legado de Elvis Presley sigue vivo y sale a la luz.

Penetration Testing With The Raspberry Pi

PwnPi is a penetration testing distribution rolled up for the Raspberry Pi platform. This should come as no surprise to anyone. The RPi board has a beefy processor, it's relatively low power, has the option of the on-board NIC or a USB WiFi dongle, and it already has Linux kernel and desktop sources available to start from.

Now we will admit we're a bit disappointed from this tip. Don't get us wrong, the distro looks like it's well done, and we're sure there are a lot of folks out there who will be happy to have these tools to help test their network security. But this is a software only hack and we were expecting to see a nice little covert package that could be plugged into an outlet (SheevaPlug style), or a battery-powered module that can be plugged into an Ethernet port and hidden away.

Now you know what we want, don't forget to send in a link once you pull it off.

[Thanks Scott]

Ubuntu Laika – An Android Phone Pen Testing Platform

Once [Ruan] over at AndroidClone heard that Android devices were capable of running a full Linux environment, he started contemplating all of the things he might be able to do with a full Linux OS in his pocket.

He decided that a portable penetration testing platform would be great to have on hand, so he got busy installing Ubuntu 10.10 on his Lenovo LePhone. Once he had it up and running, he stripped out all of the unnecessary fluff and added some common tools such as Wireshark, Nmap, and Kismet, among others. He says it easily runs side by side with Android, allowing you to switch between the Ubuntu install and your standard Android applications with ease.

While this all started out as a proof of concept, he has continued to refine the project, releasing several new versions along the way. If you are interested in giving it a try, he has installation instructions available in the AndroidClone forums.

[thanks Stephen]

How To Select The Right Pen Testing Vendor For Your SaaS Business

Rende is the founder & CEO of Rhymetec, a cybersecurity firm providing cybersecurity, compliance and data privacy needs to SaaS companies.

getty

Penetration testing (pen testing) is a cornerstone of security for SaaS businesses. However, many companies often overlook its significance, viewing it as "just another expense." With cyber threats becoming increasingly sophisticated, it's more than just checking a box; it's a proactive approach to safeguarding your business and your customers' data.

With the cost of global cybercrime forecast to increase continuously and reach $13.82 trillion by 2028, ensuring robust security measures is essential. Investing in quality pen testing is not only a must but is a strategic move to protect businesses and data.

The Value Of Quality Pen Testing

Pen testing involves experts conducting simulated cyberattacks on a computer system to unveil vulnerabilities. It's more than a security check. A comprehensive pen test provides an in-depth examination of a system's strengths and weaknesses, delivering actionable insights that significantly bolster a company's security posture.

Quality pen testing also assesses an organization's resilience against malicious attacks and ability to safeguard sensitive data. While budget-friendly, low-cost pen testing might seem economical; it often results in superficial assessments that overlook crucial vulnerabilities, which could expose businesses to unforeseen risks and costly repercussions.

A comprehensive pen test enables businesses to make informed decisions, prioritize necessary fixes and enhance their overall security posture. Continuous engagement with the pen tester throughout the process enhances its value even more; instead of just receiving a final report, businesses benefit from real-time communication and a collaborative approach.

Questions To Ask Pen Testing Vendors

Now that you know why you need a quality pen test, choosing the right vendor is essential. Where do you start? Here are some critical questions to ask to help guide your decision.

Talent And Quality Factors

1. Where is the pen testing team located? This can affect the understanding and application of regional or industry-specific regulations. This information helps establish whether the pen tester has the relevant local knowledge to conduct a thorough and compliant assessment.

2. Who will be conducting the pen test? Are they full-time or contract employees? Knowing who will perform the test helps assess the reliability and quality. Full-time employees may offer consistency and a higher level of accountability than contractors. The answer provides insights into the professionalism and commitment of the team handling the pen test, which can influence the quality and reliability of the results.

3. What are their qualifications and past experiences? This directly impacts the value and relevance of the pen test. A pen tester with substantial, hands-on experience is vital to provide confidence in the results. Knowing the pen tester's background allows an assessment of their competence, expertise and ability to handle the task.

4. How many hours will be dedicated? The time devoted reflects the depth and thoroughness of the pen test. Understanding the hours allocated helps gauge the comprehensiveness and whether it will be a detailed and valuable assessment.

Communication And Engagement

1. How will the pen tester communicate the findings? Effective communication is key to understanding and acting upon the findings. Get clarity from the vendor on how they share findings and if this will include a written report with actionable steps. The communication method impacts how easily the findings can be interpreted and applied to improve security measures. Ideally, you should be able to communicate directly with the pen tester to get clarification on any issues.

2. Will there be regular updates or just a final report? Determine in advance whether the chosen vendor provides regular updates in addition to the final report. Updates can drive a more responsive and adaptive approach to identified vulnerabilities; continuous engagement indicates a committed vendor. Knowing the frequency and style helps determine how engaged and collaborative the process will be, allowing for timely actions and decisions.

Outsourcing And Location

1. Do you outsource any services overseas? If so, where? Outsourcing can impact a vendor's control and oversight over the pen testing process. Different locations may also have varying regulations and standards concerning cybersecurity, which can affect the quality. The answer will give insights into the vendor's operational model and whether it maintains complete control over the process. It also provides information on the geographical locations, which might have different cybersecurity norms and regulations.

2. How does this impact the quality and security of the data? This question addresses the potential risks associated with outsourcing such as data integrity and confidentiality. It helps in understanding how the vendor ensures that the quality of the pen test and the security of the data are not compromised. The response will reveal the vendor's commitment to maintaining high-quality services and data security despite outsourcing. It will show the measures they have in place to safeguard data and ensure that the pen testing process remains robust and reliable.

Post-Pen Test Actions

After receiving a pen test report, the journey toward enhanced cybersecurity isn't complete. The subsequent steps and actions based on the report's findings are paramount.

• Read the report. Understanding the pen test report is essential. Focus on extracting clear, actionable insights, and avoid getting overwhelmed by technical jargon. Recognize where your vulnerabilities exist and formulate strategies to address them effectively.

• Prioritize remediation. All vulnerabilities are not of equal consequence. Address the most critical issues promptly and manage risks effectively. Adopt a strategic approach to remediation, prioritizing actions based on each vulnerability's severity and potential impact.

• Stay vigilant. Cybersecurity is a continuous journey. A single pen test is not a comprehensive solution but a component of an ongoing security strategy. Maintain regular testing and monitoring practices to ensure your defenses evolve, keeping your systems robust and secure.

Providing Profound Protection Value

Pen testing is a critical requirement for SaaS companies. It's not just about identifying vulnerabilities; it's about understanding the profound value it brings in safeguarding a business's digital assets.

For businesses aiming to thrive in a digital landscape filled with uncertainties and threats, investing in quality pen testing is not merely an option; it's a necessity. Organizations must make strategic decisions to secure a resilient and prosperous future.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?

---