Its surprising to us that people still define their network perimeter by their firewall, which is often the perceived demarcation point between the Internet and the Local Area Network (LAN). The fact of the matter is that the real demarcation point has nothing to do with the firewall at all. In fact these days the real demarcation point has more to do with the human element (you) than with technology in general.
I bring this up because the issue surfaces during penetration testing engagements frequently. Specifically, customers want penetration testing services against their perimeter but they don’t actually know what their perimeter is. Once we explain it to them their perspective on what a penetration test is changes significantly and for ever. Their perimeter is defined by any point that is accessible to an Internet based attacker, but what does that really mean?
Clearly firewalls, web servers, email servers, ftp servers, etc. are accessible to an Internet based attacker. But what about all of those services that businesses use on a daily basis that reach out to the Internet to collect data. What about what you are doing right now? You are likely reading this post in your web browser which means that you’ve reached out from the safety of your LAN to our web server. What if I told you that this blog entry was specifically designed to exploit a vulnerability in your web browser and compromise your system? Yes, by reading this blog entry your computer just got hacked. (Not really, but imagine).
Truth be told, your web browser is not the only technology that is vulnerable to this sort of attack. In fact, this is what defines a client side attack. In this case the client is your web browser, but in some cases it might be your MP3 player, your email client, your smart phone, your PDF reader, or maybe even the update functionality in your anti-virus software. Anything and everything that reaches out to third party networks from your network is a component of your network perimeter and each of those things helps to define your total attack surface. If you’re not including those types of tests when you receive penetration tests then you’re really only testing a very small fraction of your total attack surface. Considering the number of businesses that are compromised on a daily basis with client side attacks, is that really something that you can afford to overlook? Just an idea…
