Module 2 Summary

00:00

Hello and welcome to this intelligence gathering summary.

00:05

Congratulations.

00:07

What did we learn thus far with respect to the intelligence gathering component of the penetration testing execution standard? Well, we looked at general background concepts where we had Level one

00:21

tow level three information gathering level, one being pretty much clicking a button running a tool level two, including those tools and some minimal

00:29

manual analysis. And then level three being nation, state level interpretation and correlation of information. We got into some information gathering basics where we looked at what intelligence gathering was why we do intelligence gathering and what intelligence gathering was not.

00:47

We looked at target selection where we looked at identification and naming reiterated rules of engagement in limitations with target selection

00:54

consideration for time as well as goals. We have to remember that it doesn't matter if the client can't do Level three intelligence gathering because they only are able to have us to a week's worth of testing.

01:07

Then it may not be within the time constraints or in the best interest of the clients in goal.

01:12

We started off with part one of open source intelligence, where we discussed what forms Oh sint takes, which was passive active and semi passive intelligence. We looked at physical oh sent such as locations, the pervasiveness of controls throughout those locations

01:29

and the relationships of various entities. We discussed logical ascent as well as the use of the orb chart to figure out

01:37

key personnel and relationships within the client organization.

01:42

In part two of open source intelligence, we looked at electronico, sent infra infrastructure asset as well as financial information. Keeping in mind that financial data may not be is readily available for private entities as it will be for publicly traded entities who have certain reporting requirements.

02:02

And then we wrapped up our open source intelligence discussion with individual oh sent where we looked at employee data,

02:09

social network profiles, Internet presence, mobile footprint and four pay information. Taking into consideration that all of these data sets could be private in nature and may require additional research on local walls and regulations in certain areas like the United States, criminal background information that may be available

02:29

should not be used in certain circumstances or at all in some instances, and so you need to treat all of this information with the highest of sensitivity and ensure

02:38

that your rules of engagement and local laws allow you to use it in your testing

02:45

covert gathering we looked at on location gathering like Dumpster diving and things of that nature versus offsite gathering as well as discussed human intelligence. Remember, human intelligence is very interactive in nature and requires that we engage the individuals to extract yah late additional details and information.

03:04

We got into external foot printing where we discussed what footprint in was why we do it. What is external footprint in overall passive reconnaissance and active reconnaissance or foot printing techniques.

03:16

We then moved on to internal foot printing, which was, of course, the same as the external, with some added flair with respect to looking at things like active directory

03:27

shares and other infrastructure within the organization.

03:31

And then we rounded everything off with a discussion on different types of protection mechanisms that were at the network host, application, storage and user areas. These air important to understand because we can use that thio kind of figure out the customer or clients risk profile

03:49

as well as where we could potentially implement some of these controls

03:53

to further reduce risk. Now we didn't cover anyways to bypass these mechanisms or these controls. And this is really just about how we go about discussing them and looking for potential protection mechanisms that are in place within the client organization. So congratulations again.

04:11

And with that in mind, I want to thank you for your time today, and I look forward to seeing you again