You remember that router that was compromised? For proof of concept purposes, router configuration was altered to forward all Internet traffic bound for legitimate web server, to another web server where user ID, password, and account information could be collected. The first time this information was entered, customer would receive an ambiguous error. The second time page loaded, fake web server redirected customer to real site. When user re-entered requested information, everything worked just fine.

No one, not customer, nor company had any idea that something nefarious was going on. No bells or whistle went off, no one questioned error. Why would they, they could have put wrong password in, or it was likely a typical error on a web page that everyone deals with from time to time.

At this point, you can let your imagination take over. The attacker may not move forward and use information collected right away. It could be days or weeks before it is used. Any trace of what actually took place to collect information would most likely be history.

What Do You Really Get Out Of Security Assessments

----------------

I can't tell you how many times I've been presented with security assessment reports that are pretty much information output from an off-the-shelf or open source automated security analyzer. Although an attacker may use same or similar tools during an attack, they do not solely rely on this information to reach their goal. An effective penetration test or security assessment must be performed by someone who understands not only "security vulnerabilities" and how to run off-the-shelf tools. The person executing assessment must do so armed with tools and experience that meets or exceeds those a potential attacker would have.

Conclusion

----------

Whether you are a small, medium, are large company, you must be very careful about who you decide is most qualified to perform a review of your company's security defense systems, or security profile. Just because an organization presents you with credentials, such as consultants with their CISSP....., it does not mean these people have any real-world experience. All certifications in world cannot assure you results you receive from engaging in a security assessment are thorough / complete. Getting a second opinion is appropriate given what may be at stake. If you were not feeling well, and knew that something was wrong with you, would you settle for just one Doctor's opinion?

Quite frankly, I've never met a hacker (I know I will get slammed for using this term, I always do), that has a certification stating that they know what they are doing. They know what they are doing because they've done it, over and over again, and have a complete understanding of network systems and software. On top of that, one thing they have that no class or certification can teach you is, imagination.