官术网_书友最值得收藏!

Chapter 2. Penetration Testing Methodology

Penetration Testing, sometimes abbreviated as PenTest, is a process that is followed to conduct a hardcore security assessment or audit. A methodology defines a set of rules, practices, procedures, and methods that are pursued and implemented during the course of any information security audit program. Thus, penetration testing methodology defines a roadmap with practical ideas and proven practices which should be handled with great care in order to assess the system security correctly. This chapter summarizes each step of penetration testing methodology with its reasonable description which may help you to understand and focus the testing criteria with the BackTrack operating system environment. The key topics covered in this chapter include:

  • Discussion on two well-known types of penetration testing, Black-Box and White-Box
  • Exhibiting clear differences between vulnerability assessment and penetration testing
  • Explaining the industry acceptable security testing methodologies with their core functions, features, and benefits
  • The BackTrack testing methodology incorporating the ten consecutive steps of penetration testing process
  • The ethical dimension of how the security testing projects should be handled

Penetration testing can be carried out independently or as a part of an IT security risk management process that may be incorporated into a regular development lifecycle (for example, Microsoft SDLC). It is vital to notice that the security of a product not only depends on the factors relating to the IT environment, but also relies on product specific security's best practices. This involves implementation of appropriate security requirements, performing risk analysis, threat modeling, code reviews, and operational security measurement. PenTesting is considered to be the last and most aggressive form of security assessment handled by qualified professionals with or without prior knowledge of a system under examination. It can be used to assess all the IT infrastructure components including applications, network devices, operating systems, communication medium, physical security, and human psychology. The output of penetration testing usually contains a report which is divided into several sections addressing the weaknesses found in the current state of a system following their countermeasures and recommendations. Thus, the use of a methodological process provides extensive benefits to the pentester to understand and critically analyze the integrity of current defenses during each stage of the testing process.

主站蜘蛛池模板: 库伦旗| 泽州县| 阿尔山市| 西和县| 金堂县| 玉门市| 南宫市| 黑水县| 琼中| 延安市| 麻阳| 涟水县| 开平市| 凤台县| 浙江省| 安乡县| 逊克县| 黄山市| 武夷山市| 手游| 济南市| 德州市| 玛曲县| 滦南县| 耿马| 台北县| 山东| 霍城县| 张家川| 咸阳市| 山东省| 思茅市| 荃湾区| 安远县| 江川县| 景洪市| 陇川县| 南皮县| 万宁市| 东兴市| 临邑县|