官术网_书友最值得收藏!

Chapter 2. Penetration Testing Methodology

Penetration Testing, sometimes abbreviated as PenTest, is a process that is followed to conduct a hardcore security assessment or audit. A methodology defines a set of rules, practices, procedures, and methods that are pursued and implemented during the course of any information security audit program. Thus, penetration testing methodology defines a roadmap with practical ideas and proven practices which should be handled with great care in order to assess the system security correctly. This chapter summarizes each step of penetration testing methodology with its reasonable description which may help you to understand and focus the testing criteria with the BackTrack operating system environment. The key topics covered in this chapter include:

  • Discussion on two well-known types of penetration testing, Black-Box and White-Box
  • Exhibiting clear differences between vulnerability assessment and penetration testing
  • Explaining the industry acceptable security testing methodologies with their core functions, features, and benefits
  • The BackTrack testing methodology incorporating the ten consecutive steps of penetration testing process
  • The ethical dimension of how the security testing projects should be handled

Penetration testing can be carried out independently or as a part of an IT security risk management process that may be incorporated into a regular development lifecycle (for example, Microsoft SDLC). It is vital to notice that the security of a product not only depends on the factors relating to the IT environment, but also relies on product specific security's best practices. This involves implementation of appropriate security requirements, performing risk analysis, threat modeling, code reviews, and operational security measurement. PenTesting is considered to be the last and most aggressive form of security assessment handled by qualified professionals with or without prior knowledge of a system under examination. It can be used to assess all the IT infrastructure components including applications, network devices, operating systems, communication medium, physical security, and human psychology. The output of penetration testing usually contains a report which is divided into several sections addressing the weaknesses found in the current state of a system following their countermeasures and recommendations. Thus, the use of a methodological process provides extensive benefits to the pentester to understand and critically analyze the integrity of current defenses during each stage of the testing process.

主站蜘蛛池模板: 武威市| 北安市| 根河市| 安陆市| 新巴尔虎左旗| 余江县| 临汾市| 石屏县| 徐闻县| 于田县| 浙江省| 鹤庆县| 安西县| 望城县| 措美县| 诸暨市| 公安县| 图木舒克市| 那坡县| 色达县| 民和| 繁昌县| 安西县| 邛崃市| 噶尔县| 雅安市| 德钦县| 吉水县| 普宁市| 中牟县| 湘阴县| 遂溪县| 青阳县| 新巴尔虎左旗| 北宁市| 河西区| 鲁甸县| 汝南县| 饶河县| 安图县| 玛多县|