- BackTrack 4: Assuring Security by Penetration Testing
- Shakeel Ali Tedi Heriyanto
- 325字
- 2021-04-09 21:21:00
The ethics
The ethical vision of security testing constitutes rules of engagement that have to be followed by an auditor to present professional, ethical, and authorized practices. These rules define how the testing services should be offered, how the testing should be performed, determine the legal contracts and negotiations, define the scope of testing, prepare the test plan, follow the test process, and manage a consistent reporting structure. Addressing each of these areas requires careful examination and design of formal practices and procedures that must be followed throughout the test engagement. Some examples of these rules have been discussed below.
- Offering testing services after breaking into the target system before making any formal agreement between the client and auditor should be completely forbidden. This act of unethical marketing can result in the failure of a business and may have legal implications depending on jurisdictions of a country.
- Performing a test beyond the scope of testing and crossing the identified boundaries without explicit permissions from a client is prohibited.
- Binding a legal contract that should limit the liability of a job unless any illegal activity is detected. The contract should clearly state the terms and conditions of testing, emergency contact information, statement of work, and any obvious conflicts of interest.
- Scope definition should clearly define all the contractual entities and the limits imposed to them during security assessment.
- Test plan concerns the amount of time required to assess the security of a target system. It is highly advisable to draw up a schedule that does not interrupt the production of business hours.
- Test process defines the set of steps necessary to follow during the test engagement. These rules combine technical and managerial views for restricting the testing process with its environment and people.
- Test results and reporting must be presented in a clear and consistent order. The report must mark all the known and unknown vulnerabilities, and should be delivered confidentially to the authorized individual only.
推薦閱讀
- Painter繪畫實例教程
- 工業產品設計（Inventor 2010）
- Photoshop CC中文版基礎與實例教程（第7版）
- ASP.NET MVC 2 Cookbook
- 青少年美育趣味課堂：青少年學攝影修圖
- 攝影輕松入門：Photoshop后期處理
- 中文版Photoshop 2020完全自學教程
- IT Inventory and Resource Management with OCS Inventory NG 1.02
- 中文版Photoshop CC基礎教程
- UG NX12中文版實用教程
- Cassandra High Performance Cookbook
- Photoshop后期強：多重曝光專業技法寶典
- Plone 3.3 Site Administration
- 中文版3ds Max 2020基礎教程
- 中文版AutoCAD 2021完全自學教程