The State of Penetration Testing – PSW #631
Penetration testing has evolved quite a bit in the past year. As defenses shift, and in some cases get much better, attack techniques and landscapes have changed as well.
- What has changed in the past year with regards to penetration testing?
- What is adversary simulation? What are the benefits? Is the offering and consumption of this service an indication that organizations are getting better at building effective security programs?
- How has the increased popularity of breach and attack simulation tools impacted penetration testing?
- Has the MITRE attack framework impacted penetration testing? If so, how?
- Many advanced penetration testers seem to be keeping their tools private as to avoid detection by endpoint security products. Is this happening, and if so what is the impact? Should we share more? Less?
- With so many tools available today for penetration testing, what can blue teams and internal red teams do to prep for an external penetration test?
Guests
Chris possesses more than 17 years of experience as a practitioner and researcher in the security field. The author of three (soon-to-be four) best-selling books, he also teaches three distinct international courses. Chris has trained various branches of the government, including the United States Special Operations Command and the Federal Bureau of Investigation. Additionally, Chris has debriefed dozens of general officers and government officials inside the Pentagon on social engineering and its effect on the United States.
David Kennedy is founder of Binary Defense and TrustedSec. Both organizations focus on the betterment of the security industry. David also served as a board of director for the ISC2 organization. David was the former CSO for a Diebold Incorporated where he ran the entire INFOSEC program. David is a co-author of the book “Metasploit: The Penetration Testers Guide”, the creator of the Social-Engineer Toolkit (SET), Artillery, Unicorn, PenTesters Framework, and several popular open source tools. David has been interviewed by several news organizations including CNN, Fox News, MSNBC, CNBC, Katie Couric, and BBC World News. David is the co-host of the social-engineer podcast and on several additional podcasts. David has testified in front of Congress on two occasions on the security around government websites. David is one of the founding authors of the Penetration Testing Execution Standard (PTES); a framework designed to fix the penetration testing industry. David was the co-founder of DerbyCon, a large-scale conference started in Louisville, Kentucky. Prior to the private sector, David worked for the United States Marine Corps and deployed to Iraq twice for intelligence related missions.
Joe Gray, a veteran of the U.S. Navy Submarine Force, is the inaugural winner of the DerbyCon Social Engineering Capture the Flag (SECTF) and was awarded a DerbyCon Black Badge. By day, Joe is a Senior Investigator at SpyCloud in addition to being the Founder and Principal Instructor at The OSINTion.
As a member of the Password Inspection Agency, Joe has consistently performed well in Capture the Flag events, specifically those involving OSINT. Examples include 2nd Place in the HackFest Quebec Missing Persons CTF and Winning the TraceLabs OSINT Search Party during DEFCON 28 and DEFCON 29. Independently, Joe placed 4th in the DerbyCon OSINT CTF and 3rd in the National Child Protection Task Force Missing Persons CTF.
Joe has contributed material for a variety of platforms such as Forbes and Dark Reading in addition to his platforms. Joe has authored the OSINT tools DECEPTICON Bot and WikiLeaker in addition to the forthcoming book, Practical Social Engineering, due in late 2021 via NoStarch Press.
Tom Liston is a Lead Cybersecurity Instructor at Dark Matter, a security consulting firm in the UAE. He is also a Handler for the SANS Institute’s Internet Storm Center and co-author of the book Counter Hack Reloaded. In the past, he worked as the Principal Information Security Architect for Warner Brothers and spent 10 years as a Senior Security Consultant with InGuardians, Inc. – performing high-end penetration tests against Fortune 500 companies.
Ed Skoudis has taught cyber incident response and advanced penetration testing techniques to more than 12,000 cybersecurity professionals. He is a SANS Faculty Fellow and the lead for the SANS Penetration Testing Curriculum. His courses distill the essence of real-world, front-line case studies he accumulates because he is consistently one of the first experts brought in to provide after-attack analysis on major breaches where credit card and other sensitive financial data is lost.
Hosts
