Assessing your vulnerability through Pure Hacking

Assessing your vulnerability through Pure Hacking

Vishnu K. Mahmud, vmahmud@yahoo.com

Recently a Rp 1.95 billion Indonesian website was hacked by
protesters complaining about the fuel price hikes, in what
appears to be a simple vulnerability exploit.

This act of cyber sabotage could bring into question the
viability of an organization's information technology practices,
if not the company's data security as a whole. What kind of IT
personnel would allow such Internet hoodlums to deface a such an
expensive investment?

Enter Pure Hacking (www.purehacking.com). Just like out of the
movie Sneakers, Robert McAdam and his team of internet security
specialists are contracted by various organizations to fully
scrutinize the sanctity of their client's IT communications
infrastructure. Using "penetration testing", the Pure Hacking
team actually simulates what dark-hat hackers (otherwise known as
"crackers") would do when trying to take over a server or
network.

"Pure Hacking is a dedicated penetration testing firm," says
McAdam. "We will identify the risks to (our client's) business,
establish the appropriate measures to minimize the exposure to
hacking and continue to monitor the state of their security."

The Singapore and Sydney-based company is different from other
firms that offer a variety of security services such as policy
work, security architecture, and others that require resources to
be shared across the different segment areas.

Pure Hacking focuses on their one core competency, bringing a
service that remains pure and dedicated to its mandate resulting
in exceptional value for its clients, argues McAdam.

In determining whether a network or server is vulnerable to
attack, the hacking team would first "footprint" a target to
acquire all pertinent information towards launching a surgical
cyber strike. The next step would be to scan the various
listening services on a network to seek out any promising
vulnerabilities.

With this data in hand, the more intrusive probing begins, as
the testers identify poorly protected resources and gain access
into the system.

Once in, they attempt to escalate their IT privileges to
obtain complete control over the network. It is at this critical
stage that all resources, data and information within the company
are vulnerable to theft, corruption or erasure, which would of
course be costly to organizations in terms of downed systems,
missing data and lost productivity.

Not to mention potential lawsuits from irate shareholders and
angry clients.

"The security team has all the tools, techniques and know-how
to stay ahead of the criminal hacking community," notes McAdam.

"Clients cite our expertise, reliability and the excellence of
our recommendations as qualities that set us apart in the IT
security market."

It is keeping up with progress in the IT world that some
companies may have trouble with. Once an application or system is
online, there may be various patches or exploits that companies
usually miss, giving crackers a small but critical window of
opportunity.

What's more, with the wealth of intrusion tools freely
available on the Internet, anyone with little or no skill can
attempt to take over a corporate network.

These "script kiddies" usually lack the knowledge and finesse
to steal highly sensitive data, but their attempts on the system
can cause some collateral damage.

Apart from the regular penetration testing and security audit,
Pure Hacking also offers ongoing security management to ensure
that any new company changes to the systems do not introduce new
vulnerabilities.

The firm checks their client's infrastructure every business
day to see if there are any intrusion issues. Perhaps most
importantly, its reports with its specific tests, results and
recommendations cam be actionable for all levels of staff as IT
security should be a company-wide effort.

As Indonesian entities begin to upgrade their systems to
comply with international regulations, ensuring the
infrastructure is secure from possible internal and external
threats is vital to ensure business continuity. Often, McAdam
says, IT security policies demand an independent penetration test
as sound business practice.

As the world becomes more accepting (and perhaps susceptible)
to digital networks, information and transactions, extraordinary
steps must be taken to ensure confidence in systems that could be
the backbone of international commerce.

As promising as information technology is in increasing
productivity and slashing costs, it should not be a playground or
free market bazaar for crackers to steal and profit.

Pure Hacking is an endorsed supplier to the Australian Federal
government, a platinum sponsor of the Information Systems
Security Association, Singapore chapter (www.issa.org.sg), and
follows the systems and methodologies of the Open Source Security
Testing Methodology Manual (www.osstmm.org).