官术网_书友最值得收藏!

Chapter 2. Penetration Testing Methodology

Penetration Testing, sometimes abbreviated as PenTest, is a process that is followed to conduct a hardcore security assessment or audit. A methodology defines a set of rules, practices, procedures, and methods that are pursued and implemented during the course of any information security audit program. Thus, penetration testing methodology defines a roadmap with practical ideas and proven practices which should be handled with great care in order to assess the system security correctly. This chapter summarizes each step of penetration testing methodology with its reasonable description which may help you to understand and focus the testing criteria with the BackTrack operating system environment. The key topics covered in this chapter include:

  • Discussion on two well-known types of penetration testing, Black-Box and White-Box
  • Exhibiting clear differences between vulnerability assessment and penetration testing
  • Explaining the industry acceptable security testing methodologies with their core functions, features, and benefits
  • The BackTrack testing methodology incorporating the ten consecutive steps of penetration testing process
  • The ethical dimension of how the security testing projects should be handled

Penetration testing can be carried out independently or as a part of an IT security risk management process that may be incorporated into a regular development lifecycle (for example, Microsoft SDLC). It is vital to notice that the security of a product not only depends on the factors relating to the IT environment, but also relies on product specific security's best practices. This involves implementation of appropriate security requirements, performing risk analysis, threat modeling, code reviews, and operational security measurement. PenTesting is considered to be the last and most aggressive form of security assessment handled by qualified professionals with or without prior knowledge of a system under examination. It can be used to assess all the IT infrastructure components including applications, network devices, operating systems, communication medium, physical security, and human psychology. The output of penetration testing usually contains a report which is divided into several sections addressing the weaknesses found in the current state of a system following their countermeasures and recommendations. Thus, the use of a methodological process provides extensive benefits to the pentester to understand and critically analyze the integrity of current defenses during each stage of the testing process.

主站蜘蛛池模板: 沂南县| 苍山县| 锡林郭勒盟| 石城县| 开封县| 弋阳县| 济南市| 定州市| 隆子县| 武宣县| 饶平县| 洪洞县| 沐川县| 霞浦县| 偃师市| 永新县| 石楼县| 黔西县| 枣阳市| 精河县| 贺州市| 河津市| 任丘市| 襄樊市| 皋兰县| 河南省| 道真| 双城市| 新津县| 丰台区| 通化县| 遂宁市| 贵德县| 伊金霍洛旗| 许昌县| 威远县| 宁强县| 卫辉市| 攀枝花市| 景东| 潞城市|