Penetration Test Report Summary- TKC Holdings 2023.06.30.pdf
PDF 467 KB Posted
- Solicitation number
- BPM005375
- Issued by
- Arizona
About this file
This is a Penetration Test Report Summary prepared by Sikich LLP for TKC Holdings, LLC, documenting security vulnerability assessments conducted between June 5, 2023 and October 18, 2023. The engagement encompassed three distinct testing phases: external penetration testing simulating attacks from the Internet against systems accessible from outside the organization; web application penetration testing targeting eight web applications to identify weaknesses in authentication, data protection, and application behavior; and internal penetration testing simulating attacks from within the internal network to assess privilege escalation and unauthorized data access risks. Testing was designed to demonstrate compliance with the Payment Card Industry Data Security Standard (PCI DSS) and covered all perimeter and critical systems of the cardholder data environment. The external targets included 16 IP addresses and associated hostnames across multiple internet-facing systems including icsolutions.com, accesscatalog.com, accesscorrections.com, and corrlinks.com domains. The scope also included internal network segments and high-value PCI-scoped systems prioritized for testing.
Initial testing identified a total of two high-severity vulnerabilities and two medium-severity vulnerabilities across the testing domains. No vulnerabilities were identified on external targets during testing. Web application testing revealed known vulnerabilities in JavaScript libraries and end-of-life software, though server-side protections appeared to mitigate exploitation risks and no access to cardholder data was achieved. Internal testing identified instances where LDAP signing was not required but did not result in credential capture or unauthorized access to PCI systems. By the October 18, 2023 report update, TKC Holdings had successfully remediated one high-severity vulnerability and both medium-severity vulnerabilities, leaving one high-severity finding unresolved related to end-of-life software pending a complete code rewrite scheduled for 2024 deployment. Sikich recommended continued security vigilance including quarterly vulnerability scans and annual penetration testing, implementation of social engineering testing, enforcement of HSTS headers, JavaScript library remediation, and enhanced logging and monitoring capabilities to maintain PCI DSS compliance and security posture.
View the file
Other files
Show 40 more
50 files listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
PREPARED FOR:
TKC HOLDINGS, LLC
- June 5, 2023 Testing started
- June 30, 2023 Testing completed
- October 18, 2023 Report updated with results from retesting
SUBMITTED BY:
Sikich LLP
Aaron Sullivan, OSCP, Security+ Morgan Trust, Security+
SENIOR CONSULTANT ASSOCIATE CONSULTANT
17335 Golf Parkway, Suite 500 17335 Golf Parkway, Suite 500
Brookfield, WI 53045 Brookfield, WI 53045
262.317.4780 330.572.8193 aaron.sullivan@sikich.com morgan.trust@sikich.com
SIKICH.COM
October 18, 2023
PENETRATION TEST
REPORT SUMMARY
mailto:aaron.sullivan@sikich.com mailto:morgan.trust@sikich.com http://sikich.com/
October 18, 2023 | Page 2
EXECUTIVE SUMMARY
TKC Holdings, LLC (TKC Holdings) engaged Sikich LLP (Sikich) to conduct a series of penetration tests. Sikich conducted these tests between June 5, 2023 and June 30, 2023.
▪ The external penetration test simulated an attack against the TKC Holdings systems accessible from the
Internet. Sikich used tools and techniques that emulated an external attacker, such as organized criminals or a nation-state, in attempts to steal data from Internet-facing systems or gain a foothold for access into server operating systems or internal networks.
▪ The web application penetration test simulated an attack against TKC Holdings web applications. Sikich attempted to identify and exploit weaknesses in web applications that could be used to bypass authentication, steal or modify data, change the behavior of applications or gain access to servers and underlying infrastructure.
▪ The internal penetration test simulated an attack against the TKC Holdings systems from within the TKC
Holdings internal network. Sikich used tools and techniques that emulated an attacker who had gained limited access to the TKC Holdings network (perhaps through a phishing attack, rogue employee or unauthorized device) and who was trying to escalate their privileges and access sensitive data.
RESULTS SUMMARY
Using automated and manual methods, Sikich attempted to discover and exploit system-, network- and application-layer vulnerabilities.
EXTERNAL TESTING
From external targets, Sikich attempted to gain entry into the internal environment that TKC Holdings defined as being in scope for the purposes of demonstrating compliance with the Payment Card Industry Data
Security Standard (PCI DSS). Sikich did not identify vulnerabilities on external targets during testing.
WEB APPLICATION TESTING
In testing eight web applications, Sikich identified vulnerabilities that could affect customers of TKC Holdings but ultimately was unable to gain access to the internal PCI environment or cardholder data from any web application. Sikich identified JavaScript libraries in use that had known vulnerabilities and included end-of-life software, though it appeared that TKC Holdings had added protections on the sever side to protect against the vulnerabilities.
INTERNAL TESTING
Sikich attempted to gain unauthorized access into the internal PCI environment from the non-PCI environment but did not identify weaknesses or vulnerabilities that allowed it to compromise the PCI environment. Within the
PCI environment, Sikich identified and attempted to exploit instances where Lightweight Directory Access
Protocol (LDAP) signing was not required but was unable to capture credentials in network traffic during this engagement. While other vulnerabilities existed, Sikich was unable to gain privileged access to any PCI systems or data.
PENETRATION TEST REPORT | TKC HOLDINGS, LLC
Copyright © 2023 Sikich LLP. All rights reserved. This document may contain information that is privileged, confidential, or otherwise protected from disclosure and is only authorized to be used and viewed by TKC Holdings, LLC. Distribution or copying is strictly prohibited.
October 18, 2023 | Page 3
The count of vulnerabilities for the entire penetration test was:
HIGH MEDIUM LOW
2 2 ---
UPDATED OCTOBER 18, 2023
TKC Holdings demonstrated that they resolved one of the identified exploitable high-severity vulnerabilities and both of the identified exploitable medium-severity vulnerabilities.
For the remaining End-of-Life Software finding, TKC Holdings stated that they were undergoing a complete code rewrite and expected the web applications to be deployed in 2024.
Following remediation, the count of vulnerabilities was:
HIGH MEDIUM LOW
1 --- ---
This penetration test was a point-in-time measurement. It was limited in time and resources, whereas a real attacker may not be. New security vulnerabilities are discovered every day. As a result, it is nearly impossible to identify all vulnerabilities within an environment or application. TKC Holdings should perform an exhaustive search of their network for vulnerabilities discovered in this penetration test to verify there are no other instances of these vulnerabilities.
TKC Holdings should continue to review their security posture, including performing vulnerability scans on at least a quarterly basis and performing penetration testing on at least an annual basis.
PENETRATION TEST REPORT | TKC HOLDINGS, LLC
Copyright © 2023 Sikich LLP. All rights reserved. This document may contain information that
October 18, 2023 | Page 4
METHODOLOGY
Sikich performs testing with the cooperation of representatives from TKC Holdings.
PHASES
When performing penetration testing, Sikich follows a methodology based on National Institute of Standards and
Technology (NIST) Special Publication 800-115 that encompasses planning, reconnaissance, vulnerability detection, exploitation and reporting phases.
ADDITIONAL DISCOVERY
VULNERABILITY
DETECTION
PLANNING
RECONNAISSANCE EXPLOITATION
REPORTING
PHASE I: PLANNING
In the planning phase, Sikich creates a Rules of Engagement document that defines targets, documents management approval and sets testing goals.
PHASE II: RECONNAISSANCE
In the reconnaissance phase, Sikich attempts to identify and obtain information about the targets within scope.
This includes pertinent information about the organization such as names and contact information of IT staff, information employees may have posted to Internet forums or other items Sikich may uncover through focused
Internet searches.
Sikich scans targets on commonly used TCP and UDP ports and attempts to identify active services (e.g., web server, mail server) running. Devices or services that are powered off, offline or inaccessible during scanning may not yield results. Unexpected downtime of the target environment may impact the amount of reconnaissance completed on individual devices or services.
Sikich also attempts to obtain further information about potential web applications by searching for pertinent data, including unlinked content, hidden directories and version numbers of application components.
PENETRATION TEST REPORT | TKC HOLDINGS, LLC
Copyright © 2023 Sikich LLP. All rights reserved. This document may contain information that
October 18, 2023 | Page 5
PHASE III: VULNERABILITY DETECTION
During the vulnerability detection phase, Sikich attempts to discover and validate vulnerabilities on the systems enumerated in the reconnaissance phase, including by performing vulnerability scans. Sikich will not attempt to verify each of the vulnerabilities identified during scanning but provides the results of automated testing to TKC Holdings.
Sikich utilizes updated vulnerability detection methods and tools based on the most recent threats and techniques identified. Through testing of the targeted systems and services, Sikich focuses on discovering vulnerabilities in five (5) domains:
- Application Security – Strengths and weaknesses of application code, configuration, patch levels and protection of data that resides in the application
- Access Control – Strengths and weaknesses of controls over files, directories, web content and other data
- Network Security – Strengths and weaknesses of networking devices and security of network traffic
- Operating System Security – Strengths and weaknesses of operating systems’ security (e.g., Windows, UNIX)
- User Management – Security of user accounts, passwords and other unique identifiers
For web application testing, Sikich focuses on discovering the Top 10 Web Application Security Risks identified by the Open Web Application Security Project (OWASP).1 At the time of testing, these were:
1. Broken Access Control
2. Cryptographic Failures
3. Injection
4. Insecure Design
5. Security Misconfiguration
6. Vulnerable and Outdated Components
7. Identification and Authentication Failures
8. Software and Data Integrity Failures
9. Security Logging and Monitoring Failures
10. Server-Side Request Forgery (SSRF)
In situations where multiple instances of a web application exist, TKC Holdings may elect to have Sikich perform the majority of its testing against a representative sample. Sikich will provide details about specific sampled instances within the Testing Scope and Attack Narrative sections of the report. If Sikich does not review all instances of the web applications, TKC Holdings should perform follow-up testing on all instances, especially those that are exposed externally to the Internet.
1 OWASP Top 10:2021 (https://owasp.org/Top10/)
PENETRATION TEST REPORT | TKC HOLDINGS, LLC
Copyright © 2023 Sikich LLP. All rights reserved. This document may contain information that https://owasp.org/Top10/A01_2021-Broken_Access_Control/ https://owasp.org/Top10/A02_2021-Cryptographic_Failures/ https://owasp.org/Top10/A03_2021-Injection/ https://owasp.org/Top10/A04_2021-Insecure_Design/ https://owasp.org/Top10/A05_2021-Security_Misconfiguration/ https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/ https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/ https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/ https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/ https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ https://owasp.org/Top10/
October 18, 2023 | Page 6
PHASE IV: EXPLOITATION
In the exploitation phase, Sikich takes the vulnerability information and uses it to obtain access to otherwise restricted data, take control of systems, impersonate users and perform other actions designed to demonstrate the potential consequences of the vulnerabilities discovered. During this phase, Sikich also attempts to chain exploits in sequence to further penetrate TKC Holdings systems, escalate access privileges to systems and identify additional vulnerabilities.
As this engagement has clear goals and is limited by time, Sikich prioritizes attack paths that could lead to system-level access or sensitive information. Sikich may not attempt to identify or validate every vulnerability that could potentially exist in the tested environment.
DENIAL OF SERVICE
Sikich neither attempts to exploit denial of service (DoS) vulnerabilities, nor conducts activities that have the potential to significantly affect normal business operations. When Sikich encounters evidence of vulnerabilities or suspects that such vulnerabilities exist, Sikich documents the evidence as a finding. TKC Holdings should further investigate these vulnerabilities in a controlled environment, as an attacker could exploit these vulnerabilities without regard to the availability of the TKC Holdings systems.
PHASE V: REPORTING
In the reporting phase, Sikich documents discovered vulnerabilities, attempts at exploitation and recommended remediation actions. Sikich also records the results of TKC Holdings efforts made toward remediating identified vulnerabilities.
As part of its testing methodology, Sikich performs additional discovery, repeating reconnaissance, vulnerability detection and exploitation phases as needed, as it uncovers more information or successfully leverages exploits to gain access to additional systems or networks.
PENETRATION TEST REPORT | TKC HOLDINGS, LLC
Copyright © 2023 Sikich LLP. All rights reserved. This document may contain information that
October 18, 2023 | Page 7
TESTING SCOPE
Sikich received information for the purposes of limiting the testing to TKC Holdings-specified targets. TKC Holdings reported that this scope covered all perimeter and critical systems of the cardholder data environment (CDE).
EXTERNAL TARGETS
Sikich targeted the following external resources. As this testing was intended to demonstrate compliance with the PCI
DSS, Sikich has indicated which targets TKC Holdings identified as being in scope for that purpose.
IP ADDRESS HOSTNAME(S)
12.106.59.249 ---
12.106.59.250 ---
63.128.100.40 icsonline.icsolutions.com
63.128.100.41 icsagent.icsolutions.com
63.128.100.80 betaagent.icsolutions.com
199.200.5.94 www.smartdeposit.com
199.200.5.97 mycarepack.com
199.200.5.125 securepayment.accesscatalog.com
199.200.5.126 securepayment-test.accesscatalog.com
199.200.5.149 secure.icsolutions.com
199.200.5.150 kskservices.accesscorrections.com, services.accesscorrections.com
199.200.5.156 cc.corrlinks.com
199.200.5.157 cctest.corrlinks.com
199.200.5.192 accesscatalog.com, www.accesscatalog.com
199.200.5.210 accesscorrections.com, www.accesscorrections.com
199.200.5.226 pay.keefegp.com
216.243.226.160 corrlinks.com, www.corrlinks.com
PENETRATION TEST REPORT | TKC HOLDINGS, LLC
Copyright © 2023 Sikich LLP. All rights reserved. This document may contain information that http://icsonline.icsolutions.com/ http://icsagent.icsolutions.com/ http://betaagent.icsolutions.com/ http://www.smartdeposit.com/ http://mycarepack.com/ http://securepayment.accesscatalog.com/ http://securepayment-test.accesscatalog.com/ http://secure.icsolutions.com/ http://kskservices.accesscorrections.com/ http://services.accesscorrections.com/ http://cc.corrlinks.com/ http://cctest.corrlinks.com/ http://accesscatalog.com/ http://www.accesscatalog.com/ http://accesscorrections.com/ http://www.accesscorrections.com/ http://pay.keefegp.com/ http://corrlinks.com/ http://www.corrlinks.com/
October 18, 2023 | Page 8
HIGH-VALUE SYSTEMS
TKC Holdings identified the following systems as high-value networks or hosts that might be specifically targeted by an attacker. Sikich made targeting these systems a higher priority during testing.
IP ADDRESS HOSTNAME(S) DESCRIPTION
Any PCI-scoped host --- ---
WEB APPLICATION TARGETS
Sikich targeted the following web applications and focused on discovering the Top 10 Web Application Security Risks identified by OWASP.
NAME (TESTING URL(S)) PRODUCTION URL CREDENTIALS REQUIRED
Access Catalog
(https://securepayment.accesscatalog.com, https://www.accesscatalog.com)
Same Yes, self-registered
Access Corrections
(https://pay.keefegp.com, https://services.accesscorrections.com, https://www.accesscorrections.com)
Same Yes, self-registered
CorrLinks
(https://cc.corrlinks.com, https://www.corrlinks.com)
Same Yes, self-registered
Inmate Calling Solutions Agent
(https://icsagent.icsolutions.com, https://secure.icsolutions.com)
Same Yes, provided
Inmate Calling Solutions Agent – Beta
(https://betaagent.icsolutions.com, https://secure.icsolutions.com)
Same Yes, provided
Inmate Calling Solutions Online
(https://icsonline.icsolutions.com, https://secure.icsolutions.com)
Same Yes, provided
MyCarePack
(https://mycarepack.com)
Same Yes, self-registered
Smart Deposit
(http://www.smartdeposit.com)
Same Yes, self-registered https://securepayment.accesscatalog.com/ https://www.accesscatalog.com/ https://pay.keefegp.com/ https://services.accesscorrections.com/ https://www.accesscorrections.com/ https://cc.corrlinks.com/ https://www.corrlinks.com/ https://icsagent.icsolutions.com/ https://secure.icsolutions.com/ https://betaagent.icsolutions.com/ https://secure.icsolutions.com/ https://icsonline.icsolutions.com/ https://secure.icsolutions.com/ https://mycarepack.com/ file:///C:/Users/mcoates/Downloads/(http:/www.smartdeposit.com)
October 18, 2023 | Page 9
INTERNAL TARGETS
Sikich targeted resources in the following internal networks. As this testing was intended to demonstrate compliance with the PCI DSS, Sikich has indicated which targets TKC Holdings identified as being in scope for that purpose.
SUBNET NAME CLIENT-PROVIDED DESCRIPTION
Confidential
Confidential Corporate subnet
Confidential Confidential AccessSecurePak database segment
Confidential Confidential CDE management segment
Confidential Confidential Goverlan segment
Confidential Confidential CDE vHost management segment
Confidential Confidential Access Catalog prod SQL segment
Confidential Confidential Access Catalog test SQL segment
Confidential Confidential Infrastructure staging segment
Confidential Confidential vCenter management segment
Confidential Confidential Citrix segment
Confidential Confidential SCCM Kiosk segment
Confidential Confidential AccessSecurePak DMZ
Confidential Confidential Load balancer segment
Confidential Confidential Keefe segment
Confidential Confidential Keefe test segment
Confidential Confidential Access Catalog prod segment
Confidential Confidential Access Catalog test segment
Confidential Confidential ATG Corrlinks prod segment
HIGH-VALUE SYSTEMS
TKC Holdings identified the following systems as high-value networks or hosts that might be specifically targeted by an attacker (e.g., CDE systems). Sikich made targeting these systems a higher priority during testing.
NETWORK OR HOST
Any PCI-scoped host
DESCRIPTION
SAMPLING
Sikich did not perform additional sampling outside of the methodology and process described within this document.
PENETRATION TEST REPORT | TKC HOLDINGS, LLC
Copyright © 2023 Sikich LLP. All rights reserved. This document may contain information that
October 18, 2023 | Page 10
EXCLUSIONS
This was a targeted penetration test. Sikich excluded other resources not specifically defined above from testing.
PENETRATION TEST REPORT | TKC HOLDINGS, LLC
Copyright © 2023 Sikich LLP. All rights reserved. This document may contain information that
October 18, 2023 | Page 11
NETWORK SEGMENTATION TESTING
PCI DSS Requirement 11.3.4 requires penetration testing to validate that segmentation controls and methods are operational, effective and isolate all out-of-scope systems from systems in the CDE.
In addition, the PCI DSS states:
“To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the
CDE, such that even if the out-of-scope system component was compromised it could not impact the security of the CDE.”
TKC Holdings stated that only the corporate subnet could access the CDE, and the subnet was segmented by a firewall from the PCI networks that processed cardholder data. TKC Holdings staff accessed the PCI networks via remote desktop connections to a jump box, which made use of multi-factor authentication.
NETWORK IP ADDRESS GATEWAY CLIENT-PROVIDED DESCRIPTION
Confidential Confidential Confidential Corporate subnet
Sikich also attempted to gain access to the internal PCI environment from the Internet as part of external testing.
IDENTIFIED ACCESS
Sikich was able to access the following hosts and ports in the PCI environment from the non-PCI network location.
ACCESSIBLE PCI HOST ACCESSIBLE PORTS
Confidential 3389/tcp
Confidential 3389/tcp
Confidential 3389/tcp
Confidential 3389/tcp
Confidential 3389/tcp
Confidential 3389/tcp
Confidential 443/tcp
Confidential 443/tcp
October 18, 2023 | Page 12
While PCI hosts and ports were accessible, Sikich was unable to compromise the hosts or gain unauthorized access to
PCI systems or data during network segmentation testing.
PENETRATION TEST REPORT | TKC HOLDINGS, LLC
Copyright © 2023 Sikich LLP. All rights reserved. This document may contain information that
October 18, 2023 | Page 13
BEST PRACTICE RECOMMENDATIONS
Sikich documented all significant findings in the body of this penetration test report. Additional best practices for TKC
Holdings, discovered throughout the course of penetration testing, are listed below. These recommendations should be reviewed and implemented as time and project budgets permit.
- Perform social engineering testing
- Resolve any findings identified as part of vulnerability scanning
- Implement a program to proactively monitor publicly available breach data for signs of compromised accounts
- Make sure that accurate logs are gathered that include the source IP address of all requests, logs are retained for at least one year, at least three months of log data is immediately available for analysis, and automatic monitoring and alerting are implemented
- Determine if JavaScript libraries were implemented in an insecure manner and upgrade to the latest stable versions
- Enforce HSTS by adding the Strict-Transport-Security header to web application responses
PENETRATION TEST REPORT | TKC HOLDINGS, LLC
Copyright © 2023 Sikich LLP. All rights reserved. This document may contain information that
October 18, 2023 | Page 14
© 2023 Sikich LLP
All Rights Reserved.
Limitation of Liability: Sikich is not responsible for photographic or typographic errors. In no event is Sikich or its licensors liable for any indirect, punitive, incidental, special, consequential or other damages whatsoever, whether arising out of or in any way connected with the use or performance of services, related deliverables or related websites, with the delay or inability to use any deliverables, services, related equipment or related websites, the provision of or failure to provide services, or otherwise arising out of the use of services, whether based on contract, strict liability or otherwise.
Warranty: This report and services are delivered AS IS, and Sikich does not and cannot warrant the accuracy, performance or results obtained by using recommendations provided during any service or that the results or recommendations will be error-free or complete.
Sikich makes no warranty that the services will detect all vulnerabilities or any particular vulnerability or the services will provide the most recently developed or distributed vulnerability checks. Sikich makes no warranties, express or implied, as to noninfringement of third-party rights, merchantability or fitness for any particular purpose.
Trademarks: Sikich’s mark may not be used in connection with any product or service that is not Sikich’s in any manner that is likely to cause confusion, or in any manner that disparages or discredits Sikich.
Microsoft and Windows are trademarks or registered trademarks of Microsoft Corporation.
Other company, product and service names may be trademarks or service marks of others.
Sikich LLP
877.403.5227 support@sikichlabs.com http://www.sikichlabs.com
PENETRATION TEST REPORT | TKC HOLDINGS, LLC
Copyright © 2023 Sikich LLP. All rights reserved. This document may contain information that mailto:support@sikichlabs.com http://www.sikichlabs.com/
File details come from the government source that posted it. Updated .