官术网_书友最值得收藏!

Chapter 2. Penetration Testing Methodology

Penetration Testing, sometimes abbreviated as PenTest, is a process that is followed to conduct a hardcore security assessment or audit. A methodology defines a set of rules, practices, procedures, and methods that are pursued and implemented during the course of any information security audit program. Thus, penetration testing methodology defines a roadmap with practical ideas and proven practices which should be handled with great care in order to assess the system security correctly. This chapter summarizes each step of penetration testing methodology with its reasonable description which may help you to understand and focus the testing criteria with the BackTrack operating system environment. The key topics covered in this chapter include:

  • Discussion on two well-known types of penetration testing, Black-Box and White-Box
  • Exhibiting clear differences between vulnerability assessment and penetration testing
  • Explaining the industry acceptable security testing methodologies with their core functions, features, and benefits
  • The BackTrack testing methodology incorporating the ten consecutive steps of penetration testing process
  • The ethical dimension of how the security testing projects should be handled

Penetration testing can be carried out independently or as a part of an IT security risk management process that may be incorporated into a regular development lifecycle (for example, Microsoft SDLC). It is vital to notice that the security of a product not only depends on the factors relating to the IT environment, but also relies on product specific security's best practices. This involves implementation of appropriate security requirements, performing risk analysis, threat modeling, code reviews, and operational security measurement. PenTesting is considered to be the last and most aggressive form of security assessment handled by qualified professionals with or without prior knowledge of a system under examination. It can be used to assess all the IT infrastructure components including applications, network devices, operating systems, communication medium, physical security, and human psychology. The output of penetration testing usually contains a report which is divided into several sections addressing the weaknesses found in the current state of a system following their countermeasures and recommendations. Thus, the use of a methodological process provides extensive benefits to the pentester to understand and critically analyze the integrity of current defenses during each stage of the testing process.

主站蜘蛛池模板: 杭州市| 读书| 洛阳市| 邯郸市| 九江市| 濮阳县| 绥阳县| 日喀则市| 碌曲县| 孝感市| 泰兴市| 朝阳市| 璧山县| 通山县| 布拖县| 岐山县| 公主岭市| 离岛区| 东乡族自治县| 清新县| 襄垣县| 克山县| 宁强县| 琼海市| 望江县| 西安市| 花垣县| 沂源县| 高陵县| 介休市| 托克托县| 民乐县| 康平县| 繁昌县| 井研县| 棋牌| 黑河市| 来宾市| 民丰县| 四子王旗| 九龙县|