An Introduction to Penetration Testing as Code Framework (PAC) Video Series

In today’s world, businesses are under constant attack from cybercriminals. To protect themselves, they need to have a plan in place that includes the use of penetration testers. These experts can help find and exploit vulnerabilities in systems, but the process can be time-consuming and expensive. The future of offensive security lies in automation, and that is where penetration testing as code comes into play. In a series of videos, we are discussing how this new approach can help you create the next generation of security that is both efficient and cost-effective.

These are the topics we are covering in this series of videos:

• Vulnerability assessment and penetration testing
• Challenges with manual vulnerability assessments and manual penetration testing
• Automated penetration testing to the rescue
• Automated Pentesting vs DAST
• Automated pentesting – a perfect fit for cloud applications at scale
• Why security validation as code?
• Offensive Security at scale
• Build attack ready cloud with shift-left
• Stop the game of false positives
• Unify the cloud engineering and security toolsets
• Future of offensive security in the cloud
• Seamless discovery
• Wrap up

Check this page regularly and we update it with the links to new videos when they become available!

PAC Video Series – Vulnerability assessment and penetration testing

If you’re responsible for the security of a system or network, you need to know about penetration testing. Penetration testing is the simulated exploitation of vulnerabilities to assess the damage that could be done. It’s a critical part of compliance and regulation, because it’s the best way to identify and fix vulnerabilities before they can be exploited. And it helps protect your customers and their data. In this blog post, we’ll discuss what penetration testing is and why you need it.

                            

Penetration testing is a process of identifying, quantifying, and ranking vulnerabilities in systems or networks. It’s done by simulating the exploitation of those vulnerabilities to assess the damage that could be done. Penetration testing is a critical part of compliance and regulation for several reasons. One, because it’s the best way to identify and fix vulnerabilities before they can be exploited. Two, because it provides external assurance that your security controls are adequate. And three, because it helps protect your customers and their data.

 

Is IAC scanning scalable in the GitOps era?

Introduction

Gitops is breaking down boundaries between the CI and CD processes for infrastructure projects, ensuring that your cloud resources are always in sync with your coding base. The injection of IAC scans after code commit in CD phase causes disruption.

Prancer is a static code analyzer that verifies the security settings of Kubernetes configuration files in a non-disruptive way, even if they are deployed using GitOps. Prancer platform can connect to git repositories and perform security scans in CI phase before code commit to master. This move reflects Prancer’s commitment to extend the security through multiple platforms and “shift the security to the left” at the hand of developers. Now, let’s review some background information.

What is Kubernetes Config Connector (KCC) ?

The Kubernetes Config Connector (KCC) is a library that enables you to use the Google Cloud Platform (GCP) services from your Kubernetes clusters. The KCC provides a set of APIs and tools that make it easy to manage resources in GCP, such as instances, disks, and networks. Config Connector provides a collection of Kubernetes Custom Resource Definitions (CRDs) and controllers. The Config Connector CRDs allow Kubernetes to create and manage Google Cloud resources when you configure and apply Objects to your cluster.To get more information about KCC,review this link: https://cloud.google.com/config-connector/docs/overview

 

What is K8s admission controller?

The k8s admission controller is a piece of software that screens requests to the Kubernetes API server before the persistence of the object occurs, but after authentication and authorization have been achieved. It uses a Webhook and performs validations against the Kubernetes API Server. The webhook is an external service that receives requests for validation. The admission controller then calls this webhook if it requires information about a request, such as whether to allow or reject the request based on some custom logic implemented by you.

To get more information about Kubernetes Admission Controller, review this link: https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/

Challenges with KCC policy Controller

Many companies are using Kubernetes Gatekeeper and admission control project to apply security guardrails to the Kubernetes Object files. but they see some problems that we want to address here.

First of all, the GitOps approach is not scaling as the policy scanning happens at the CD instead of CI. With modern Shift-Left DevSecOps tools available from Prancer and other vendors, DevOps engineers now need a fast response. The way Gatekeeper project is working is at the CD time. it means when we are deploying the Kubernetes Object Files to the Kubernetes cluster, the admission controller kicks in and check for misconfiguration. This approach takes time and does not scale in a way the team can work in an agile manner.

The second problem is If multiple resources are getting deployed policy controller checks the resources in a sequence, deploys the resources with good config, and blocks the deployment when policy fails. This creates a limbo and operational nightmare to roll back the working state.

The last item we want to cover here is all of these things are adding additional loads on the KCC clusters. The cluster computing power should support the main functions and respond to the cluster users, but we are wasting that power for the controls and guardrails, which can easily be offloaded to the Static Code Analysis phase of KCC.

How Prancer can solve problems of the Kubernetes Admission Controller for KCC

Prancer Static Code Analysis engine can understand the details of the GCP KCC files and is the only provider capable of scanning KCC files. Prancer can scan the KCC files BEFORE you deploy them to the Kubernetes cluster. The scans will happen in the CI phase before handing over the code to CD for deployment. This is a new way of security integration with GCP and Kubernetes, allowing developers and DevOps engineers to catch misconfigurations at an early stage in the process, rather than waiting for the CD process to begins.

Since the code scanning is happening at the CI level, if a problem exists in the code, the pipeline fails and prevents any resource to be deployed to the Kubernetes cluster and GCP subsequently.

This early detection of misconfigurations and security vulnerabilities in the code gives developers a lot more control over their Kubernetes Configuration.

Prancer Static Code Analysis tool can understand KCC files and provide the list of issues before deployment to your GCP account. This approach is extremely effective when it comes to reducing operational overhead while increasing the productivity of developers.

To understand the current test cases related to GCP KCC files, you can review the Prancer compliance database at this link: https://github.com/prancer-io/prancer-compliance-test/tree/master/google/kcc

Challenges with manual vulnerability assessments and manual penetration testing

The biggest challenge with manual vulnerability assessments and penetration testing is that it’s slow, expensive, and doesn’t scale with modern CI/CD strategies. It can take weeks or even months to find and exploit all the vulnerabilities in a system. And it’s challenging for security teams to keep up with the ever-changing landscape of security threats.

The first challenge is about the pentesting coverage. Security pentesters can only test what they know and see. They need to be aware of all the potential vulnerabilities in order to exploit them. But with new security threats emerging every day, it’s impossible for pentesters to know everything.

The second challenge is about the accuracy of the findings in pentesting results. Usually, there are lots of false positives and true negatives in the findings of pentesters. This is because pentesters can only test the reachable attack surface that they see and know. It’s impossible for them to exploit every possible vulnerable endpoint in a system. And it’s also difficult for pentesters to understand how an application works in its code level, so it’s easy for them to have lots of false positives or true negatives in their findings.

The next challenge for manual pentesting is triage validation of the results. Security teams need to verify all the findings and prioritize which ones are critical so they can be fixed. This is a very time-consuming process that takes lots of effort from security professionals. And it’s difficult for them to prioritize based on their knowledge and experience.

The last challenge with manual pentesting which we want to talk about here is CI / CD integration. It is not possible to integrate pentesing to application developers pipeline and create an automated system out of that. Pentesters need to manually review and validate the findings from their pentesting results which is not possible to automate.

PAC Video Series – Vulnerability assessment and penetration testing

If you’re responsible for the security of a system or network, you need to know about penetration testing. Penetration testing is the simulated exploitation of vulnerabilities to assess the damage that could be done. It’s a critical part of compliance and regulation, because it’s the best way to identify and fix vulnerabilities before they can be exploited. And it helps protect your customers and their data. In this blog post, we’ll discuss what penetration testing is and why you need it.

Penetration testing is a process of identifying, quantifying, and ranking vulnerabilities in systems or networks. It’s done by simulating the exploitation of those vulnerabilities to assess the damage that could be done. Penetration testing is a critical part of compliance and regulation for several reasons. One, because it’s the best way to identify and fix vulnerabilities before they can be exploited. Two, because it provides external assurance that your security controls are adequate. And three, because it helps protect your customers and their data.