Pen Testing The Empire
[no description provided][Updated with a leaked copy of the response from Imperial Security.]
To: Grand Moff Tarkin
Re: "The Pentesters Strike Back" memo
Classification: Imperial Secret/Attorney Directed Work Product
Sir,
We have received and analyzed the "Pentesters Strike Back" video, created by Kessel Cyber Security Consulting, in support of their report 05.25.1977. This memo analyzes the video, presents internal analysis, and offers strategies for response to the Trade Federation.
In short, this is typical pen test slagging of our operational security investments, which meet or exceed all best practices. It is likely just a negotiating tactic, albeit one with catchy music.
Finding 1.3: "Endpoints unprotected against spoofing." This is true, depending on a certain point of view. Following the execution of Order 66, standing policy has been "The Jedi are extinct. Their fire has gone out of the universe." As such, Stormtrooper training has been optimized to improve small arms accuracy, which has been a perennial issue identified in after-action reports.
Finding 2.1: "Network Segmentation inadequate." This has been raised repeatedly by internal audit, perhaps this would be a good "area for improvement" in response to this memo.
Finding 4.2: "Data at rest not encrypted." This is inaccurate. The GalactiCAD server in question was accessed from an authorized endpoint. As such, it decrypted the data, and sent it over an encrypted tunnel to the endpoint. The pen testers misunderstand our network architecture, again.
Finding 5.1: "Physical access not controlled." Frankly, sir, this battle station is the ultimate power in the universe. It has multiple layers of physical access control, including the screening units of Star Destroyers and Super SDs, Tie Fighters, Storm Trooper squadrons in each landing bay, [Top Secret-1], and [Top Secret-2]. Again, the pen testers ignore facts to present "findings" to their clients.
Finding 5.2: "Unauthorized mobile devices allows network access." This is flat-out wrong. In the clip presented, TK-427 is clearly heard authorizing the droids in question. An audit of our records indicate that both driods presented authorization certificates signed by Lord Vader's certificate authority. As you know, this CA has been the source of some dispute over time, but the finding presented is, again, simply wrong.
Finding 7.4: "Security incident response times need improvement." The incident response times are excellent. Commander Sheard, who was watch officer in Control Station West, had Storm Troopers at Detention Block AA23 before the attackers were able to exit the short corridor of the block, forcing them to blast holes in the wall. (The walls were built to resistance standard 4-15, able to resist a wookie pounding on them for 15 minutes, which would have allowed TD-787 and his squad to stop for caf en route, had not unrelated failures led to the prisoners having charged blasters.)
Finding 8.3: "Legacy intruder-tracking system inadequately concealed." Again, this claim simply has no basis in fact. The intruder-tracking system worked perfectly, allowing the Imperial Fleet to track the freighter to Yavin. In analyzing the video, we expect that General Orgena's intuition was "Force"-aided.
In summary, there are a few minor issues identified which require attention. However, the bulk of the report presents mis-understandings, unreasonable expectations, and focuses heavily on a set of assumptions that just don't bear up to scrutiny. We are in effective compliance with PCI-DSS, this test did not reveal a single credit card number, and the deal with the Trade Federation should not be impeded.
Via Bruce Schneier.