- BackTrack 4: Assuring Security by Penetration Testing
- Shakeel Ali Tedi Heriyanto
- 370字
- 2021-04-09 21:20:58
Chapter 2. Penetration Testing Methodology
Penetration Testing, sometimes abbreviated as PenTest, is a process that is followed to conduct a hardcore security assessment or audit. A methodology defines a set of rules, practices, procedures, and methods that are pursued and implemented during the course of any information security audit program. Thus, penetration testing methodology defines a roadmap with practical ideas and proven practices which should be handled with great care in order to assess the system security correctly. This chapter summarizes each step of penetration testing methodology with its reasonable description which may help you to understand and focus the testing criteria with the BackTrack operating system environment. The key topics covered in this chapter include:
- Discussion on two well-known types of penetration testing, Black-Box and White-Box
- Exhibiting clear differences between vulnerability assessment and penetration testing
- Explaining the industry acceptable security testing methodologies with their core functions, features, and benefits
- The BackTrack testing methodology incorporating the ten consecutive steps of penetration testing process
- The ethical dimension of how the security testing projects should be handled
Penetration testing can be carried out independently or as a part of an IT security risk management process that may be incorporated into a regular development lifecycle (for example, Microsoft SDLC). It is vital to notice that the security of a product not only depends on the factors relating to the IT environment, but also relies on product specific security's best practices. This involves implementation of appropriate security requirements, performing risk analysis, threat modeling, code reviews, and operational security measurement. PenTesting is considered to be the last and most aggressive form of security assessment handled by qualified professionals with or without prior knowledge of a system under examination. It can be used to assess all the IT infrastructure components including applications, network devices, operating systems, communication medium, physical security, and human psychology. The output of penetration testing usually contains a report which is divided into several sections addressing the weaknesses found in the current state of a system following their countermeasures and recommendations. Thus, the use of a methodological process provides extensive benefits to the pentester to understand and critically analyze the integrity of current defenses during each stage of the testing process.
- Microsoft Visual C++ Windows Applications by Example
- Spring Python 1.1
- 中文版Premiere影視編輯課堂實錄
- Microsoft BizTalk Server 2010 Patterns
- 中文版Illustrator CC基礎培訓教程(移動學習版)
- 中文版 Photoshop CC 從入門到精通
- IT Inventory and Resource Management with OCS Inventory NG 1.02
- 輕松玩轉3D One AI
- SPSS統計分析
- Excel 2010 Financials Cookbook
- 企業微信公眾平臺開發實戰:再小的個體也有自己的品牌
- Joomla! 1.5 JavaScript jQuery
- AutoCAD 2016從入門到精通
- 選擇的藝術:Photoshop圖像處理深度剖析(第3版)
- 新手學UG NX 8.0輔助設計