METHOD MEETS INTELLIGENCE
Penetration Testing Methodology
___
The methodology documented below is the method used by all Block8.ai penetration tests to ensure a consistent and effective testing methodology. The following graphic provides a very high level overview of this methodology.
These steps are based on the Open Web Application Security Project (OWASP), the US National Institute of Standards and Technology (NIST) methodology and best practice as appropriate to testing using Artificial Intelligence (AI) toolsets. These 5 steps are broken down below.
Engage
Vulnerability Assesment
AI Vulnerability Exploitation
Reporting
Re-Testing (as Required)
Engagement
The engagement step includes, as a minimum the following key stages:
Client Details – Capture the relevant Client Information.
Definition of Scope – Clearly define the target, what is to be tested (systems, networks, applications) and importantly, what (if anything) is to be excluded.
Payment – Via Credit Card and/or Purchase Order.
Vulnerability Assessment
The Vulnerability Assessment step includes, as a minimum the following the following key stages:
Reconnaissance – Gather all available information pertinent to the target system or network (within scope). Reconnaissance may be achieved through both passive or active techniques (i.e. public sources or technical scanning).
Fingerprinting – Identifying operating system and running service information including the technology stack, operating systems of systems and network or other devices within the in-scope environment.
Automated Scanning – Scanning conducted using vulnerability identification tools as selected by the Block8.ai team.
Analysis – the use of Block8.ai’s proprietary AI toolset to analyse the vulnerabilities identified through the scanning process. Vulnerabilities are assessed to see if they are actual or false positive and if they have the potential to be exploited.
AI Vulnerability Exploitation
The AI Vulnerability Exploitation step includes, as a minimum the following key stages:
Exploiting Vulnerabilities – the use of Block8.ai’s proprietary artificial intelligence toolset to leverage identified vulnerabilities with the aim of exploiting them to permit unauthorised activities such as access or control.
Post-Exploitation – If permitted within the scope of the engagement. Additional exploitation of the compromised system in an attempt to escalate access privileges or access sensitive date or to move laterally through the target environment.
Reporting
The Reporting step includes, as a minimum the following key stages:
Executive Report
Provides a non-technical overview of the engagement including result statistics and severity levels
Technical Report
Detailed Findings – All identified vulnerabilities will be documented along with the severity and the potential impact on the client organisation should that vulnerability be exploited.
Remediation Recommendations – Actionable activities that can be conducted by the client to reduce the potential impact from identified vulnerabilities.
Human Validation – Block8’s human subject matter experts will review all findings and recommendations as validation of the AI processes.
Certificate
Provision of a one-page letter with no technical details that the client can confidently publicise to their external stakeholders as an assurance that testing has been conducted.
Re-Testing (as Required)
The Re-Testing step includes, as a minimum the following key stages:
Re-Testing is conducted if a request is received within 45 days of the issue of the report.
Re-Testing is conducted only on previously identified Critical and/or High Vulnerabilities with the aim of establishing if the previously identified vulnerabilities have been remediated.
Re-Testing includes the issue of revised reporting (all three reports).
Scoring Methodology
___
The methodology documented is the method used by all Block8 penetration tests to score the vulnerabilities identified through the testing process. All scoring is based on the Internationally recognised Common Vulnerabilities and Exposures (CVE) system. This is fully documented within the Common Vulnerability Scoring System (CVSS) scores. Vulnerabilities are scored on a scale of 0.0 through to 10.0 on a sliding scale of severity with 10.0 being the highest.
Where the vulnerability discovered has not as yet been allocated a value under the CVSS then an assessment is to be made based on the process defined through the CVSS website. Assessments are to err on the side of caution and accept the potential for over scoring until such time as a CVSS score has been officially allocated.
Block8 Severity Rating
CVE Score
Low
Medium
0.1 – 3.9
4.0 – 6.9
High
Critical
7.0 – 8.9
9.0 – 10.0
