Why are you asking to be Whitelisted?

Recently I have been asked by clients why we request that our scans be whitelisted when we are performing external security assessments. Many people believe that a blocked scan is the same as blocking a vulnerability which is present on a host. This could not be further from the truth. 

Let us start by discussing what your firewall is probably doing and not doing. When a firewall triggers on a scan it is usually caused by a few prospective things. These could include:

1. Lots of port requests from a single source IP
2. Failure to build a full TCP connection to multiple ports (SYN scanning)
3. A single IP attempting to connect to several IP addresses behind your firewall

There are other things, but these are the primary ways a vulnerability or port scan will get an IP address blocked by a firewall. The firewall is not usually deciding based on a payload in the network stream although some can do that. With this in mind, why would you ever want to whitelist your penetration tester?

Bang for the Buck

Let’s start with getting the most for your money. If we try to avoid detection by your security overlays (Firewalls, MSSP, IDS/IPS) it will take significantly more time to test each individual port on each individual IP address. With 65,535 ports potentially available on each IP address it is much more efficient to allow the testing entity to automate this process. For fiscal efficiency, allowing the tester to scan each device will cost less in the long run.

Accuracy

Next is accuracy. Kevin Thomas, one of our cofounders, used the following analogy for me. “Let’s say you have a home with several ground-floor windows and one of those windows is open. If I tried 2 or 3 closed windows and your security system caught me before I got to the open window, it did catch me, but that window is still open. The next time I, or someone else, might try that one first.”. The vulnerability is still present. The open window will be whatever service is allowed to run on the device and/or face the Internet. Regardless of your ruleset and configuration, it would be best to run all services as securely as possible and to be aware of what may be vulnerable on the host platform.

Complete Picture of Your Risk Profile

Lastly, is to have a complete picture of your risk profile. Knowing the potential vulnerabilities on each host that is used to generate revenue and/or reputation for your organization lets you plan a more complete strategy to protect them. Security overlays are fantastic pieces of technology that have automated some previously very difficult tasks. One of the downsides of these overlays is that they can provide a false sense of security if proper testing is not done.

With all of that said, Contextual Security Solutions is happy to perform our testing in whatever manner you believe best serves your organization. There are examples of organizations that will need their security overlays tested in conjunction with the underlying hosts. Organizations that have access to classified material, sensitive data that can cause harm, and others need to know if their protections can be penetrated. It is helpful to be aware that those efforts take more time and therefore cost more money.