Scribd
Upload
67 views24 pages

Functional Testing: A New Era of Pentesting

The document discusses the differences between penetration testing and functional testing in the cloud. It notes that while penetration testing focuses on finding technical vulnerabilities, functional testing takes a more holistic approach by also evaluating identity and access management, security groups, and the overall security posture. Functional testing incorporates standard penetration testing tactics but also looks for systemic vulnerabilities and how securely credentials are managed, since over 75% of cloud breaches involve stolen credentials. The document argues that moving to the cloud requires new skill sets for security engineers, including training in functional testing and cloud-specific platforms like AWS and GCP. It promotes an approach of first educating people, then evaluating security, deploying controls, and maintaining continuous monitoring and evaluation of operations and culture.

Uploaded by

Tom Donald Clarke
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
67 views24 pages

Functional Testing: A New Era of Pentesting

The document discusses the differences between penetration testing and functional testing in the cloud. It notes that while penetration testing focuses on finding technical vulnerabilities, functional testing takes a more holistic approach by also evaluating identity and access management, security groups, and the overall security posture. Functional testing incorporates standard penetration testing tactics but also looks for systemic vulnerabilities and how securely credentials are managed, since over 75% of cloud breaches involve stolen credentials. The document argues that moving to the cloud requires new skill sets for security engineers, including training in functional testing and cloud-specific platforms like AWS and GCP. It promotes an approach of first educating people, then evaluating security, deploying controls, and maintaining continuous monitoring and evaluation of operations and culture.

Uploaded by

Tom Donald Clarke
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 24

Functional Testing

A New Era of Pentesting


● Introduction
● Recap: Penetration Testing
Agenda ●
●
Recap: Cloud Services
Security Issues & Trends
● Contrast: Pentest vs Functional Test
● Moving Forward: Offsec & Cloud Tech
$ whoami > Moos1e.txt
● Manager of Pentest Community
○ Cobalt.io (Cobalt Labs)
● Founder
○ Offensive Security Interviews
● Adjunct Professor (Online)
○ CityU of Seattle
○ National University
● Author
○ AWS Penetration Testing by Packt
● Ph.D. Student @ DSU
○ Ph.D. of Cyber Operations
● Masters of Cybersecurity
○ Focus in ethical hacking and
pentesting
● OSCP
Penetration Testing (Pentesting)

Penetration testing, also known as pentesting,


pentest or ethical hacking, is an authorized
simulated cyberattack on a computer system,
performed to evaluate the security of the
system.
Pentesting Cont...
Penetration testing is more than just
“hacking things”. In fact, penetration
testing is a lot more research and writing
than actual hacking. Copious amounts of
research and discussion have to take
place before any hands hit the keyboards.

Additionally, once a pentest is concluded,


reporting and discussion on how to fix the
issues must take place!
Pentesting Cont...

Reality Check

● It’s about people and processes


● Technical skills play a major role
○ Soft skills play a vital role

You have to concurrently be able to walk the


walk, and talk the talk
Cloud Services

Market Share Majority DoD Market Share Familiar Service


Cloud Breaches

1. Misconfigurations maintain as the largest 1. Lack of training in security groups and


issue. security controls within cloud services
a. Continuous rise in cloud market does not 2. Lack of understanding the use of cloud
match the upkeep for training staff on secrets
cloud
3. Moving faster than staffing education can
2. Key’s left in open repositories
keep up
a. AWS Keys are a BIG HIT
3. Many companies move to cloud
a. Remote Workforce (COVID)
b. Budget Cuts
c. Want to stay up to date
d. Scaling
What Causes Confusion?
Threat TTPs
Pentesting Functional Testing
● Typically looks for vulnerabilities in: ● Understands security is built into services.
○ Software ● Incorporates standard pentesting
○ Networks tactics
○ Applications
● Adds Flare
○ System Vulnerabilities
○ Looks for systemic vulnerabilities
● Mix between automated and manual
○ Evaluates IAM and Groups
○ Scanning tools (Nessus, Qualysis, Burp)
○ Analyzes and Evaluates security posture
○ Open Source Tools from QA Perspective.
○ Public Exploits
● 77% of cloud breaches involved breached
○ Manual Testing
credentials.
○ Must have credentials prior to testing!
Pentesting Functional Testing
Doesn’t Work Works
Thinking Outside The Box
● Certain cloud services require new skill
sets.
○ Steep learning curve
■ GCP
○ STEEPEST
■ AWS
● Train Cloud Security Engineers
○ Functional Testing
○ Pentesting
○ Offensive Security
● Integrate Security Awareness
○ Educate 1st
○ Evaluate 2nd
○ Deploy 3rd
○ Continuous monitoring and evaluating
■ Operations
■ Culture
Follow Me
LinkedIn: Jon Helmus
Twitter: @Moos1e_Moose
Medium: @jonathanchelmus
Offensive Security Interviews
- www.offsecinterviews.com

Cobalt.io (Cobalt Labs)


- Currently looking for freelance pentesters!
- Reach out to the Managers of Community
- Elizabeth Ramirez
- Jon Helmus

You might also like