Automating as many processes as possible reduces the time and effort that we have to put into our jobs – but sometimes it also results in unintended consequences. A feature in some IPS systems is “reputation filtering.” It works by reporting the originating IP address of a detected attack to a reputation service. The address is added to the service’s database, and a score assigned to the IP address. Traffic from addresses that cross a specified score threshold is blocked by the IPS.
That’s all well and good, except when we deliberately attack our own or our clients’ networks as part of penetration testing. If those attacks are detected and your address gets into the database, you may find yourself with a problem. That’s the topic of this post, New Risks in Penetration Testing, by Rob VandenBrink: