This is the presentation materials for Mandiri Community of Information Security event - "Infosec Awareness Night" - 26 November 2018

1. Ahmad Muammar WK, OSCE, OSCP, eMAPT
Pen-testing is Dead
Information Security Awareness Night ?

2. Ahmad Muammar.WK,
OSCE, OSCP, eMAPT
✤ Professional hacker/Penetration tester
✤ Doing offensive security/hacking
since 2002; Doing it professionally
since 2007.
✤ Founder of echo.or.id & idsecconf.org
✤ Web: http://me.ammar.web.id
✤ email: me@ammar.web.id,
y3dips@echo.or.id
✤ twitter: @y3dips

4. Pen-testing is Dead?
✤ Pen-Testing is Dead, Long Live the Pen Test - Taylor
Banks & Carric - Defcon 16 (2008)
✤ Penetration Testing Is Dead! (Long Live Penetration
Testing!) - Katie Moussouris (Chief Policy Officer -
HackerOne) - Pen Test Hackfest Summit & Training
(November 2014)

5. U Say Dead?
✤ Misconception
✤ Bug Bounty Programs
✤ Red Team Arise
✤ Agile Development
✤ Industry 4.0 Technology

6. Misconception: U say Pen-test?
✤ We all say “Pen-test” and we all do Pen-test!
✤ Honestly, it was Vulnerability Assessment.

7. Misconception: Pen-test..
✤ It should be equal to “Hackers” Activity.
✤ Unlimited scope, unlimited timeframe, unlimited
attack vector. (?)
✤ Validate vulnerability (POC), gaining Access, “mass
owning”, +social engineering.

8. Bug-Bounty Killed Pen-Test?
✤ Bug Bounty limited to online target.
✤ Bug Bounty not cover a development state (UAT, SIT).
✤ Bug Bounty not suitable to test private system (send
2FA token for e-banking login to all bounty hunters?).

9. Bug-Bounty Needed Pen-Test
✤ Some problems for un-prepared company:
✤ A poorly-implemented Bug Bounty will just spoil your
relations with the security community and create a bad
reputation for your company.
✤ Make sure to have enough technical and human resources to
handle, analyze and properly follow-up the submissions.
✤ Hard to specify “Criminals” amongs bounty hunters.
✤ “pen-test 1st, do bounty afterwards”.

11. RedTeam Slaughtered Pen-Test?
✤ A Red Team Assessment is similar to a penetration test
in many ways but is more targeted (simulate an APT).
✤ The goal is to test the organization's detection and
response capabilities.
✤ Target are often have penetration tests done, have
patched most vulnerabilities, and have generally
positive penetration test results.
Penetration Test vs. Red Team Assessment: The Age Old Debate of Pirates vs. Ninjas Continues - https://blog.rapid7.com/2016/06/23/penetration-testing-vs-red-teaming-the-age-old-debate-of-pirates-vs-ninja-continues/

12. RedTeam comply Pen-Test
✤ You would not want to use a Penetration Test to judge
how well your incident response is and you would not
want to perform a Red Team assessment to discover
vulnerabilities.
Penetration Test vs. Red Team Assessment: The Age Old Debate of Pirates vs. Ninjas Continues - https://blog.rapid7.com/2016/06/23/penetration-testing-vs-red-teaming-the-age-old-debate-of-pirates-vs-ninja-continues/

13. Pen-test wont work in Agile?
Images taken from: https://www.seguetech.com/waterfall-vs-agile-methodology/

14. Pen-test won’t work in Agile?
“Penetration Testing in Agile Software Development Cycle (scrum framework)” Martin Tomanek and Tomas Klima - https://arxiv.org/ftp/arxiv/papers/1504/1504.00942.pdf

15. Pen-test also work in Agile
“Penetration Testing in Agile Software Development Cycle (scrum framework)” Martin Tomanek and Tomas Klima - https://arxiv.org/ftp/arxiv/papers/1504/1504.00942.pdf

16. Industry 4.0 won’t need Pen-test?
Images taken from: https://www.researchgate.net/profile/Fernando_Deschamps/publication/319944621/figure/download/fig1/AS:613928782532631@1523383436460/
Technologies-for-industry-40.png

18. Internet-Connected Medical Washer-Disinfector Found Vulnerable to Hacking

19. Ahmad Muammar WK, OSCE, OSCP, eMAPT
Pen-testing is not Dead!
Information Security Awareness Night