16.1 Kali Linux in an Assessment

The CIA Triad: What You Are Defending

Every security assessment exists to answer one question: how well does this organization protect its information? The industry measures that protection against the CIA triad — Confidentiality, Integrity, and Availability. The KLCP exam expects you to define each leg and recognize real-world examples of each failing.

• Confidentiality means information is accessible only to authorized parties. A confidentiality failure is unauthorized disclosure: an attacker exfiltrating a customer database, a misconfigured S3 bucket leaking payroll spreadsheets, or an unencrypted laptop full of medical records being stolen. Tools and controls that protect confidentiality include encryption at rest (LUKS disk encryption), encryption in transit (TLS), and access controls.
• Integrity means information and systems are modified only in authorized ways. An integrity failure is unauthorized modification: an attacker altering a payment amount in transit, a web defacement, a tampered software update, or bit-flipping in a database. Hashing (SHA-256 checksums), digital signatures, and file-integrity monitors protect integrity.
• Availability means systems and data are accessible to authorized users when needed. An availability failure is disruption: a denial-of-service flood taking a storefront offline, ransomware encrypting a file server, or a failed disk with no backup. Redundancy, backups, and DDoS mitigation protect availability.

A classic exam trap is confusing integrity with confidentiality. Reading a file you should not see violates confidentiality; changing that file violates integrity. An attack can violate one, two, or all three at once — ransomware, for example, breaks availability first and confidentiality second if data is also stolen.

Where Kali Linux Fits in the Assessment Lifecycle

Kali Linux is not a single tool; it is a purpose-built workbench whose 600+ preinstalled packages map onto every phase of a professional assessment. Knowing which phase a tool belongs to is a recurring exam theme, so internalize the five-phase methodology — and note that the book labels the same five phases to match the Kali Applications menu categories: Information Gathering, Vulnerability Discovery, Exploitation, Pivoting and Exfiltration, and Reporting:

1. Reconnaissance (information gathering). You collect everything publicly or passively knowable about the target before touching it — domain registrations, employee names from LinkedIn, exposed subdomains, leaked credentials, and technology fingerprints. Passive reconnaissance generates no traffic the target can observe; active reconnaissance (like DNS zone transfers) does. Kali tools: theHarvester, whois, dig, dnsrecon, Maltego, and Recon-ng.
2. Scanning (enumeration and vulnerability analysis). Now you touch the target deliberately: port scans, service and version detection, OS fingerprinting, and vulnerability scans. Kali tools: nmap (and its scripting engine, NSE), masscan, openvas (GVM), and nikto. The output of this phase is a list of live hosts, open ports, and candidate weaknesses.
3. Exploitation. You attempt to turn a weakness into actual access — running an exploit against an unpatched service, cracking a captured password hash, or tricking a user into running a payload. Kali tools: the Metasploit Framework (msfconsole), sqlmap, hydra, and exploit code from searchsploit (the local Exploit-DB copy).
4. Post-exploitation. With a foothold established, you demonstrate business impact: privilege escalation, lateral movement, pillaging sensitive files, and establishing persistence. This phase separates a real penetration test from a scan — it proves what an attacker could actually do. Kali tools: Meterpreter, Mimikatz, BloodHound, and LinPEAS/WinPEAS.
5. Reporting. The phase juniors skip and clients pay for. You document every finding with evidence (screenshots, command output), severity, and remediation guidance. Tools like Dradis and Faraday help organize evidence, but the deliverable is the written report.

Risk: Likelihood Combined with Impact (NIST SP 800-30)

Assessments do not just find holes; they prioritize them. The standard vocabulary comes from NIST Special Publication 800-30, Guide for Conducting Risk Assessments, which defines risk as a function of two inputs:

Risk = a combination of Likelihood and Impact (NIST scores that combination on a Low/Moderate/High matrix; it is not a multiplication formula)

• Likelihood is the probability that a threat source will exploit a vulnerability. A default password on an internet-facing login page has very high likelihood; the same password on an air-gapped lab machine has almost none.
• Impact is the magnitude of harm if exploitation succeeds — measured against the CIA triad. Dumping the entire customer database is high impact; defacing a marketing blog is comparatively low.

This framing matters practically: an assessor who finds 400 vulnerabilities but cannot rank them has delivered noise. Combining likelihood with impact turns findings into a prioritized remediation list, which is exactly what the reporting phase delivers. A medium-severity bug on a payment server can outrank a high-severity bug on a decommissioned test box. NIST rates likelihood, impact and the resulting risk each as Low, Moderate or High and reads the answer off a matrix — note that a high-impact finding with low likelihood is reduced, never amplified. On the exam, remember the two named components — likelihood and impact — and that NIST SP 800-30 is the source document.

NIST SP 800-30 also supplies the surrounding vocabulary: a threat source is the actor or event capable of causing harm, a vulnerability is the weakness that can be exploited, and a threat event is an event or situation with the potential to cause undesirable consequences (a set of related ones is a threat scenario). Risk assessment pairs these with the organization's assets to decide where testing effort and security budget go first — which is why the cardholder data environment gets penetration tested before the cafeteria menu board.

Preparing Kali for the Field

Before any of the phases above, the book is emphatic about the machine itself, and this is the most commonly tested part of the topic:

• One clean install per engagement. Never carry a single Kali installation from client to client. Over an assessment you inevitably hand-tweak things you will not remember, and — far worse — leftover notes, loot and scripts risk cross-contaminating one client's data into another's engagement.
• Automate the rebuild so "clean" is cheap. A preseeded unattended install or a custom live ISO turns "start fresh" from an afternoon into a coffee break, which is exactly why the customization chapters come before this one.
• Encrypt the disk, and consider the nuke password for travel. Full-disk encryption protects client data if the laptop is stolen; before crossing a border you can send an encrypted copy of the key to a colleague and then nuke the local decryption key, restoring it afterwards.
• Pre-install the toolset the job needs. Wireless work: kali-tools-wireless. Web-application work: kali-tools-web. Intrusion investigation: kali-tools-forensics, booted in forensics mode so no disk is auto-mounted and swap is never touched. Assume you will have no usable internet on site.
• Audit your own attack surface. Re-check network settings and what is listening on your assigned IP — excessive listening services can get you detected and shut down before you start.

Kali's Design Choices That Matter in Assessments

Several Kali defaults exist specifically to support assessment work and are frequently tested. Kali's custom kernel is patched for wireless injection, which enables Wi-Fi assessments with tools like the Aircrack-ng suite. Network services such as SSH and Apache are disabled by default, so an assessor's own machine does not become an attack surface. The distribution is FHS-compliant and based on Debian Testing as a rolling release, meaning your tools update continuously with sudo apt update && sudo apt full-upgrade rather than waiting for a major version. And because Kali is built with live-build, you can run an entire assessment from a bootable USB — including encrypted persistence for storing client evidence safely on-site.