Assurance and the Limits of Penetration Testing

Lesson plan

Level

Beginner

Time

About 50 minutes; the steps below add up to 50

Learners explain how a roof can leak a year after a clean survey, and what last month’s test supports, before scope, time and method are named. Predictions then precede what any check must decide, what separates a test from an attack, why a breach can follow a clean test, where structures stop and what must follow a report; checks follow monitoring, report sensitivity and the fictional company’s breach. The habit to build: ask what was in scope, when, what was found and whether it was fixed.

Objectives

• Explain that every form of assurance has a scope, a time and a method
• Compare what assessments, certificates, tests and monitoring can and cannot show
• Describe how a penetration test is bounded, and why a breach can follow a clean test
• Use assurance well: know the scope, act on findings, retest and combine forms

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the GRC and Treating Risk lessons first.
• Keep the four bounds of a test (scope, timeframe, rules of engagement, output) on the board.
• The lesson takes about 50 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain that every form of assurance has a scope, a time and a method
   • Compare what assessments, certificates, tests and monitoring can and cannot show
   • Describe how a penetration test is bounded, and why a breach can follow a clean test
   • Use assurance well: know the scope, act on findings, retest and combine forms

   Purpose: Learners explain how a roof can leak a year after a clean survey, and what last month’s test supports, before scope, time and method are named. Predictions then precede what any check must decide, what separates a test from an attack, why a breach can follow a clean test, where structures stop and what must follow a report; checks follow monitoring, report sensitivity and the fictional company’s breach. The habit to build: ask what was in scope, when, what was found and whether it was fixed.

2. 1. The house survey Think 5 min

   Purpose: Raise the limits of any check with a house survey.

   Ask

   • Why could the roof leak?
   • What does last month’s test support?

   Responses to expect

   • Time and wear come first; what the surveyor could not see needs a prompt.
   • On screen in turns: the opening question, its answer; then the question on last month’s test, and its answer.

   Discussion pause: Let learners list reasons before revealing.

   In the lesson window

   • Think it through: A surveyor checks a house before you buy it and finds nothing wrong with the roof. A year later the roof leaks. List the reasons this could happen without the survey having been wrong.
   • Think it through: A website passed a two-week penetration test last month. Which claim does that support?

3. 2. Assurance answers a specific question Predict 7 min

   Purpose: Compare forms of assurance and what each cannot show.

   Ask

   • What must any check decide?
   • What does monitoring show?

   Responses to expect

   • Many treat certificates as guarantees.
   • On screen in turns: the opening question, its answer; then forms of assurance, with what each does not show held back; what each does not show; the check question on what monitoring shows, and its answer; passing one check while failing another.

   Misconceptions to challenge

   • A learner may believe: “Certification means a breach cannot happen.” Respond: It confirms the scoped management system met requirements when audited.
   • A learner may believe: “Compliance and security are the same thing.” Respond: Compliance shows requirements met; security depends on facing real threats.

   Discussion pause: The “does not show” column is held back: for each form of assurance, ask what it cannot prove before revealing it.

   In the lesson window

   • Think it through: Any check of security has to decide three things before it starts. What might they be?
   • Check your understanding: A company runs a 24/7 monitoring centre. Using the table, what can that show?

4. 3. What a penetration test is Predict 8 min

   Purpose: Define a penetration test and how it is bounded, with the narrowing diagram.

   Ask

   • What makes a test a test?
   • Why is the report sensitive?

   Responses to expect

   • Permission comes quickly.
   • Diagram: build the narrowing from the top; at each stage ask what has just been left out.
   • On screen in turns: the opening question, its answer; then how a test is bounded, starting with scope; timeframe; rules of engagement; output; the check question on why the report is sensitive, and its answer; how a test narrows, starting with everything the organisation relies on; what was in scope; what there was time for; what the report describes; kinds of penetration test.

   To go further

   • Which kind of test in the Go deeper list would best show how well defenders notice an attack?

   In the lesson window

   • Think it through: A tester and a criminal might use exactly the same techniques against the same website. What makes one a test and the other an attack?
   • Check your understanding: Why is a penetration test report treated as highly sensitive?

5. 4. Why a breach can follow a clean test Predict 7 min

   Purpose: Explain the two limits and the further reasons, with the fictional company.

   Ask

   • Two reasons for a breach after a clean test?
   • How did the attacker get in?

   Responses to expect

   • The out-of-scope supplier surprises some.
   • On screen in turns: the opening question, its answer; then two limits, starting with the bounded test; the unbounded attacker; further reasons; a clean test, then a breach, starting with month 1; month 3; month 4; the test was not wrong; the check question on which route the attacker used, and its answer.

   Misconceptions to challenge

   • A learner may believe: “A clean penetration test means we are secure.” Respond: It speaks for its scope and time only.

   In the lesson window

   • Think it through: Before reading on, give two reasons a company could be breached a month after a clean penetration test.
   • Check your understanding: In the fictional company, how did the attacker get in?

6. 5. Thinking like an attacker Predict 4 min

   Purpose: Draw the lesson about assumptions from the LulzSec case.

   Ask

   • Where do structures stop?

   Responses to expect

   • The gaps between teams.
   • On screen in turns: the opening; then the question on where structures stop, and its answer; asking what an assessment might miss.

   If the explanation does not land: Ask who owns the corridor between two classrooms: everyone and nobody.

   In the lesson window

   • Think it through: Defenders follow defined structures. Where might an attacker look that a structure does not reach?

7. 6. Using assurance well Predict 5 min

   Purpose: Set out the practices: know the scope, act, retest, combine.

   Ask

   • What must follow twelve findings?

   Responses to expect

   • Owners and retesting are often forgotten.
   • On screen in turns: the opening question, its answer; then using assurance well, starting with knowing the scope; acting on findings; retesting; combining forms; questions to ask about a pass.

   In the lesson window

   • Think it through: A penetration test report lists twelve findings. What has to happen next for the test to have been worth doing?

8. 7. Apply it in a new situation Apply 5 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The certificate tests scope; the payments test retesting; the board tests choosing the right form.
   • On screen in turns: the opening; then the question on a certified cloud supplier, and its answer; the question on payments added after a test, and its answer; the question on the website and customer data, and its answer.

   In the lesson window

   • Apply it: A cloud supplier says, “We are ISO/IEC 27001 certified.” What is the most useful follow-up question?
   • Apply it: A company tests its new app before launch, then adds payments a month later. What should follow?
   • Apply it: A board wants to know whether attackers could get from the public website to customer data. Which form of assurance answers that best?

9. 8. Check your understanding Check 6 min

   Purpose: Check the lesson against the approved revision-bank questions.

   Ask

   • Answer individually, then compare before revealing.

   Responses to expect

   • The breach-after-test question links to that step.
   • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

10. 9. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the three things every form of assurance is limited by.

    Responses to expect

    • Scope, time and method.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

11. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Scope, time, method.
    • Each form shows something different.
    • A test is bounded; an attacker is not.
    • Look for the gaps between structures.
    • Act, retest, combine.

Consolidation

• Scope, time, method.
• Each form shows something different.
• A test is bounded; an attacker is not.
• Look for the gaps between structures.
• Act, retest, combine.