Ahmad Muammar discusses the misconceptions surrounding penetration testing, arguing that it is not dead but evolves alongside practices like bug bounty programs and red team assessments. He emphasizes that while these methods serve distinct purposes, they should complement each other to ensure thorough security evaluations. The presentation highlights the importance of adapting penetration testing to modern development practices, such as Agile methodologies and Industry 4.0 technologies.

1. Ahmad Muammar WK, OSCE, OSCP, eMAPT
Pen-testing is Dead
Information Security Awareness Night ?

2. Ahmad Muammar.WK,
OSCE, OSCP, eMAPT
✤ Professional hacker/Penetration tester
✤ Doing offensive security/hacking
since 2002; Doing it professionally
since 2007.
✤ Founder of echo.or.id & idsecconf.org
✤ Web: http://me.ammar.web.id
✤ email: me@ammar.web.id,
y3dips@echo.or.id
✤ twitter: @y3dips

4. Pen-testing is Dead?
✤ Pen-Testing is Dead, Long Live the Pen Test - Taylor
Banks & Carric - Defcon 16 (2008)
✤ Penetration Testing Is Dead! (Long Live Penetration
Testing!) - Katie Moussouris (Chief Policy Officer -
HackerOne) - Pen Test Hackfest Summit & Training
(November 2014)

5. U Say Dead?
✤ Misconception
✤ Bug Bounty Programs
✤ Red Team Arise
✤ Agile Development
✤ Industry 4.0 Technology

6. Misconception: U say Pen-test?
✤ We all say “Pen-test” and we all do Pen-test!
✤ Honestly, it was Vulnerability Assessment.

7. Misconception: Pen-test..
✤ It should be equal to “Hackers” Activity.
✤ Unlimited scope, unlimited timeframe, unlimited
attack vector. (?)
✤ Validate vulnerability (POC), gaining Access, “mass
owning”, +social engineering.

8. Bug-Bounty Killed Pen-Test?
✤ Bug Bounty limited to online target.
✤ Bug Bounty not cover a development state (UAT, SIT).
✤ Bug Bounty not suitable to test private system (send
2FA token for e-banking login to all bounty hunters?).

9. Bug-Bounty Needed Pen-Test
✤ Some problems for un-prepared company:
✤ A poorly-implemented Bug Bounty will just spoil your
relations with the security community and create a bad
reputation for your company.
✤ Make sure to have enough technical and human resources to
handle, analyze and properly follow-up the submissions.
✤ Hard to specify “Criminals” amongs bounty hunters.
✤ “pen-test 1st, do bounty afterwards”.

11. RedTeam Slaughtered Pen-Test?
✤ A Red Team Assessment is similar to a penetration test
in many ways but is more targeted (simulate an APT).
✤ The goal is to test the organization's detection and
response capabilities.
✤ Target are often have penetration tests done, have
patched most vulnerabilities, and have generally
positive penetration test results.
Penetration Test vs. Red Team Assessment: The Age Old Debate of Pirates vs. Ninjas Continues - https://blog.rapid7.com/2016/06/23/penetration-testing-vs-red-teaming-the-age-old-debate-of-pirates-vs-ninja-continues/

12. RedTeam comply Pen-Test
✤ You would not want to use a Penetration Test to judge
how well your incident response is and you would not
want to perform a Red Team assessment to discover
vulnerabilities.
Penetration Test vs. Red Team Assessment: The Age Old Debate of Pirates vs. Ninjas Continues - https://blog.rapid7.com/2016/06/23/penetration-testing-vs-red-teaming-the-age-old-debate-of-pirates-vs-ninja-continues/

13. Pen-test wont work in Agile?
Images taken from: https://www.seguetech.com/waterfall-vs-agile-methodology/

14. Pen-test won’t work in Agile?
“Penetration Testing in Agile Software Development Cycle (scrum framework)” Martin Tomanek and Tomas Klima - https://arxiv.org/ftp/arxiv/papers/1504/1504.00942.pdf

15. Pen-test also work in Agile
“Penetration Testing in Agile Software Development Cycle (scrum framework)” Martin Tomanek and Tomas Klima - https://arxiv.org/ftp/arxiv/papers/1504/1504.00942.pdf

16. Industry 4.0 won’t need Pen-test?
Images taken from: https://www.researchgate.net/profile/Fernando_Deschamps/publication/319944621/figure/download/fig1/AS:613928782532631@1523383436460/
Technologies-for-industry-40.png

18. Internet-Connected Medical Washer-Disinfector Found Vulnerable to Hacking

19. Ahmad Muammar WK, OSCE, OSCP, eMAPT
Pen-testing is not Dead!
Information Security Awareness Night