Verticle TV & Music

Understanding Penetration Testing Methodology

Every company has the responsibility to organize and perform penetration testing (pen-test) of its premises and systems at certain intervals. However, few companies understand the process of penetration testing and rely on the supplier to provide all direction. Here is a brief description of a penetration testing methodology, that should aide the security officers in managing the actual test.

Definition
A penetration test (pen-test) is a controlled process in which a trusted third party performs security verification by using methods, tools and styles that would be performed by persons with malicious intent.

Elements of the pen-test

Target - a resource which will be targeted for attack during the pen-test. The target can be a single item (server, router, safe) or a set of resources with some common denominator (server farm, network segment, offices)
Trophy - a resource that the testers are tasked with extracting or destroying. Malicious attackers usually stand to gain benefit from the attack, and if the valuable resource is identified, it can be tagged as a 'trophy' to be won by the pen-testers. Bear in mind that sometimes the trophy may not be a physical item, but a loss of functionality or service that can tarnish the reputation of the company.
Test vector - the attack channel or set of channels that the pen-testers will use during the test.
Test type - which type of test will the pen-tester perform.

• Black box - the pen-tester performs the attack with no prior knowledge of the infrastructure, defence mechanisms and communication channels of the target organization. Black box test is a simulation of an unsystematic attack by weekend or wannabe hackers (script kiddies).
• Gray box - the pen-tester performs the attack with limited knowledge of the infrastructure, defence mechanisms and communication channels of the target organization. Gray box test is a simulation of a systematic attack by well prepared outside attackers or insiders with limited access and privileges.
• White box - the pen-tester performs the attack with full knowledge of the infrastructure, defence mechanisms and communication channels of the target organization. White box test is a simulation of a systematic attack by well prepared outside attackers with insider contacts or insiders with largely unlimited access and privileges.

This element differentiates from what kind of malicious attackers is the company trying to protect itself. Each next test type is not a super set of the previous one. For proper penetration testing, one has to perform all three types of test.

Process

The penetration test must be approved by top management, with proper signed decision. The decision to perform a pen-test and it's details must be maintained as highly guarded secret which is known only to the top management, the security officer of the company and internal audit.

The supplier of the test (pen-tester) must be a credible and trusted company with relevant experience. Prior to top management approval, the supplier must provide a detailed pen-test plan to be approved by the the security officer. This test plan must include details about

• the target
• the trophy
• the test vector (locations to be tested, sources of pen-test attack like phone numbers, ip addresses etc.)
• the test type (white, gray or black box)
• names and references of all persons that will perform the pen-test to be approved by the buyer
• list of tools and methodologies that will be utilized during the pen-test
• method of protecting any collected confidential information during the pen-test
• method of self-auditing the entire pen-test process
• method of buyer-auditing the entire pen-test process
• time period of the pen-test

This test plan when approved will be amended to the pen-test contract, which should also include the following:

• A clause for penalties for any damages caused by the pen-test, which should not be higher then the contract value, except when malicious intent is proven
• A clause for risky test approval in which the buyer will approve or disprove possibly risky tests. Should such tests be approved, a list of targets and tests must be included.
• A clause to confirm that there is no conflict of interest by any involved parties in the penetration test. This clause should include or be amended by full industry affiliation of all involved parties.
• A clause of full confidentiality - restriction on using the results of the test for commercial purposes; restriction on publication of references regarding the pen-test; full and utmost protection of all information, results and conclusions collected during the negotiation, preparation and pen-test regardless of existing Non-disclosure agreements.
• A clause of immediate full disclosure - all collected results and conclusions must be reported in detail, regardless of estimated severity. Each conclusion must include tools and process description used to reach the conclusion. All conclusions estimated as critical and severe must be reported as they are identified in the pen-test, and the full detailed report must be handed over in maximum 48 hours days after completion of the pen-test.

Audit

Since the penetration process is a controlled process, it must be subject to immediate and later audit. This can and should include

• on-hand surveillance of the penetration test as it is performed
• filming the entire process on video camera
• full packet capture on all interfaces through which the penetration test is performed

Finally, here is a diagram of a penetration test process

NOTE: This article does not strive to provide a full pen-test methodology. It is however based on a OSSTMM 2.2 (Open-Source Security Testing Methodology Manual), which i recommend to be read by everyone. This document is of a relatively technical nature, and will be much more helpful to penetration testers then to companies which will hire them.

About the Author

Spirovski Bozidar, CISSP, MCSA

Spirovski Bozidar is an ICT and security expert. Mr. Spirovski has worked in information management and security since 1999 His professional experience includes from Head of Systems and Security of an ISP, and Senior Solution Designer within an Incumbent Telco Opator. Bozidar currenty holds the position of a Chief Information Security Officer for bank, member of a large multinational group.
He has been involved as a guest speaker in a multitude of international conferences on information systems in CEE, covering the subjects of Personal Data protection and EU regulations, Risk Analysis and Business Continuity and Reliable Data hosting.

He is the author of the ShortInfosec Portal (http://www.shortinfosec.net)

Non Penetrating Deep Sclerectomy with CO2 LASER - Dr. Mauricio Turati Acosta

US Auctions Australian Auctions Austrian Auctions Belgian Auctions Canadian Auctions French Auctions German Auctions Irish Auctions Italian Auctions Dutch Auctions Spanish Auctions Swiss Auctions GB Auctions

Best Match Items Ending First Newly-Listed Items First Price + Shipping: Lowest First Price + Shipping: Highest First

NEW Steren Non Penetrating Roof Mount 221 110 $26.24 Time Remaining: 15d 19h 39m Buy It Now for only: $26.24 Buy It Now

10 Brand New FRM 125 60 Non Penetrating Roof Masts NIB $189.95 Time Remaining: 1h 47m

Dish Mount Non Penetrating 2 3 8 Diameter Mast $26.00 Time Remaining: 20d 15h 58m Buy It Now for only: $26.00 Buy It Now

ROHN Non Pen Penetrating Antenna Mast Roof Mount 60 x 225 inch OD $120.99 Time Remaining: 16d 6h 17m Buy It Now for only: $120.99 Buy It Now

NPR8 NON PENETRATING DIRECTV APPROVED AND DISH NETWORK MOUNT $40.00 Time Remaining: 3d 3h 13m Buy It Now for only: $40.00 Buy It Now

Antenna Mount Patio Non Penetrating Mount Assembly 167 dia x 48 Mast 177407 $49.99 Time Remaining: 18d 2h 58m Buy It Now for only: $49.99 Buy It Now

NEW Roof pad for non penetrating mount for 359 35 fits NPR6 NPR8 $22.99 Time Remaining: 13d 4h 41m Buy It Now for only: $22.99 Buy It Now

Perfect Vision NPR NPR8 Non Penetrating Flat Roof Mount NPR 8 $44.99 Time Remaining: 9d 22h 34m Buy It Now for only: $44.99 Buy It Now

11 Lot BENGAY Menthol NON GREASY Penetrating PAIN RELIEF Gel VANISHING SCENT $3.33 Time Remaining: 5d 6h 30m Buy It Now for only: $3.33 Buy It Now

Perfect Vision NPR5 Non Penetrating Antenna Mount for 18 24 KAKU Dishes NPR 5 $39.99 Time Remaining: 26d 21h 49m Buy It Now for only: $39.99 Buy It Now

Solyndra SL 100 Series Flat Roof Non Penetrating Solar Panel Mounts $10.00 Time Remaining: 1d 5h 51m Buy It Now for only: $10.00 Buy It Now

Solyndra SL 200 Series Flat Roof Non Penetrating Solar Panel SNOW Mounts $15.00 Time Remaining: 1d 6h 6m Buy It Now for only: $15.00 Buy It Now

Winegard DS 5046 Non Penetrating Roof Mount $22.00 Time Remaining: 29d 21h 8m Buy It Now for only: $22.00 Buy It Now

Non Pen Penetrating Satellite TV Antenna Roof Mount 30 inch Mast with 200 OD $79.99 Time Remaining: 13d 6h 29m Buy It Now for only: $79.99 Buy It Now

ROHN Non Pen Penetrating Antenna Mast Roof Mount 60 x 238 inch OD $159.99 Time Remaining: 16d 6h 33m Buy It Now for only: $159.99 Buy It Now

Brand New Perfect Vision NPRMAT8 Non Penetrating Mount Pitch Pad for NPR8 $14.99 Time Remaining: 1d 7h 47m Buy It Now for only: $14.99 Buy It Now

X4 NPRMAT2 Non Penetrating Roof Mount Pad 36 x 36 x 1 8 $20.00 Time Remaining: 3d 14h 45m Buy It Now for only: $20.00 Buy It Now

Non Pen Penetrating Satellite Antenna Roof Mount 125 OD Mast 60 in Length $69.99 Time Remaining: 13d 5h 14m Buy It Now for only: $69.99 Buy It Now

Non Penetrating Roof Mount 60 inch Mast with 125 OD $79.99 Time Remaining: 10h 40m Buy It Now for only: $79.99 Buy It Now

Non Pen Penetrating Satellite Dish DirecTV Roof Mount Base with Protective Mat $39.99 Time Remaining: 13d 4h 11m Buy It Now for only: $39.99 Buy It Now

Non Pen Penetrating Roof Mount for Light TV Wireless Internet Cell Antenna Base $59.99 Time Remaining: 13d 3h 38m Buy It Now for only: $59.99 Buy It Now

Non Pen Penetrating Satellite Antenna Roof Mount 200 OD Mast Height 30 $69.99 Time Remaining: 13d 5h 32m Buy It Now for only: $69.99 Buy It Now

Non penetrating patio mount assembly 167ODx48mast HW $75.00 Time Remaining: 15d 20h 42m Buy It Now for only: $75.00 Buy It Now

ROHN Non Pen Penetrating Antenna Mast Roof Mount 30 x 238 inch OD $127.99 Time Remaining: 16d 6h 21m Buy It Now for only: $127.99 Buy It Now

Non Pen Penetrating Satellite TV Antenna Roof Mount Protective Rubber Mat Pad $19.99 Time Remaining: 12d 23h 55m Buy It Now for only: $19.99 Buy It Now

Non Penetrating Roof Mount 30 inch Mast with 166 OD $79.99 Time Remaining: 10h 52m Buy It Now for only: $79.99 Buy It Now

Non Pen Penetrating Roof Mount Mast Adapter for Changing 200 to 2375 OD $14.99 Time Remaining: 13d 6h 57m Buy It Now for only: $14.99 Buy It Now

ROHN Non Pen Penetrating Antenna Mast Roof Mount 30 x 150 inch OD $119.99 Time Remaining: 16d 6h 9m Buy It Now for only: $119.99 Buy It Now

Non Penetrating Mount for Satellite Dish $89.99 Time Remaining: 28d 49m Buy It Now for only: $89.99 Buy It Now

ROHN Non Pen Penetrating Antenna Mast Roof Mount 60 x 125 inch OD $117.99 Time Remaining: 16d 5h 59m Buy It Now for only: $117.99 Buy It Now

Non Pen Penetrating Satellite Antenna Roof Mount 2375 OD Mast Height 30 $79.99 Time Remaining: 13d 5h 34m Buy It Now for only: $79.99 Buy It Now

Non Pen Penetrating Satellite TV Antenna Roof Mount 30 inch Mast with 166 OD $79.99 Time Remaining: 13d 6h 24m Buy It Now for only: $79.99 Buy It Now

Non Pen Penetrating DirecTV DISH Network Slimline Pitched Satellite Roof Mount $84.99 Time Remaining: 12d 23h 51m Buy It Now for only: $84.99 Buy It Now

ROHN Non Pen Penetrating Antenna Mast Roof Mount 30 x 166 inch OD $119.99 Time Remaining: 16d 6h 13m Buy It Now for only: $119.99 Buy It Now

Non Penetrating Roof Mount 30 inch Mast with 2375 OD $89.99 Time Remaining: 11h 6m Buy It Now for only: $89.99 Buy It Now

Non Pen Penetrating Satellite Antenna Roof Mount 166 OD Mast Height 30 $69.99 Time Remaining: 13d 5h 30m Buy It Now for only: $69.99 Buy It Now

Non penetrating roof mount satellite dish antenna $59.99 Time Remaining: 29d 21h 58m Buy It Now for only: $59.99 Buy It Now

A 1 Satellite NPRMAT1 Non Penetrating Mount Pitch Pad 39 Length x 2450 $22.06 Time Remaining: 20d 7h 21m Buy It Now for only: $22.06 Buy It Now

Roof pad for non penetrating mount for 18 or 24in Dish $12.99 Time Remaining: 4d 20h 38m Buy It Now for only: $12.99 Buy It Now

Non-Penetrating Glaucoma Surgery List Price: $169.95 Sale Price: $51.20 See Reviews For This Product Description Univ. of Lausanne, Switzerland. Test gives a broad outline of the history and evolution of treatment for glaucoma, and discusses two recently developed approaches: deep sclerectomy and viscocanalostomy...

Non - Penetrating Roof Mount 2" for satellite dish List Price: $149.99 Sale Price: $49.99 You save: $100.00 (67%)   Eligible for free shipping! Availability: Usually ships in 1-2 business days See Reviews For This Product Description non penetrating foof mount satellite mount This is the Non-Penetrating Roof Mount 2" for the Slimline Dish 2" Mast Diameter Minor adjustment of mast pitch from 2 degrees positive to 10 degrees negative Black powder coated steel construction 1...

Non-Penetrating Glaucoma Surgery List Price: $159.95 See Reviews For This Product Description Containing over 150 color and 50 black and white illustrations, this book provides a broad outline of the history and evolution of treatment for glaucoma. It presents the latest non-penetrating surgical techniques for glaucoma and combined cataract and glaucoma surgery, offering expertise from an international team of contributors...

Moisture Encounter Plus Non-Destructive Moisture Meter by Tramex Sale Price: $330.00   Eligible for free shipping! Availability: Usually ships in 1-2 business days See Reviews For This Product Description Item Number: TR115 The Moisture Encounter PLUS is an upgraded version of the worlds most popular and successful non-destructive moisture meter the Moisture Encounter. The Moisture Encounter PLUS incorporates all the features and benefits found in the original Moisture Encounter such as: Non-destructive moisture measurement of wood, plaster, drywall, block, brick, roofing and most materials found in the building envelope using 3 ranges of sensitivity...

AminoGenesis Photolagen-AFG Penetrating Repair Serum, Full Strength Non-Prescription, 2-Ounces List Price: $89.00 Sale Price: $53.99 You save: $35.01 (39%)   Eligible for free shipping! Availability: Usually ships in 1-2 business days See Reviews For This Product Description Intensive treatment for sun damage, photo depletion and prematurely aged skin (solar elastosis). Enhanced with AGF proprietary amino acids. Patented pentapeptide technology clinically proven to: Dramatically reduce fine lines & wrinkles up to 68%; Infuse moisture deep into the skin; Reverse damage caused by sun & natural aging; Diminish appearance of age spots; Reduce the appearance of dark circles; Improve skin firmness, texture and feel...

LIQUID WRENCH NON-FLAM. SUPER LUBE--11 OZ. AERO. List Price: $5.79 Sale Price: $3.17 You save: $2.62 (45%)   Eligible for free shipping! Availability: Usually ships in 1-2 business days See Reviews For This Product Description One can does it allloosens rusted nuts and bolts, releases frozen and corroded parts, frees seized joints and mechanisms, lubricates locks, hinges, and casters.Stops sqeals and squeaks.Displaces moisture and inhibits corrosion.

Ultrasonic Rodent Repeller Direct Plug In: Save with Set of 3 Single Speaker Units List Price: $59.85 Sale Price: $39.95 You save: $19.90 (33%)   Eligible for free shipping! Availability: Usually ships in 24 hours See Reviews For This Product Description 3 pack of Single Speaker Rodent Repellers. Non-toxic ultrasonic rodent repellers are specifically designed to repel rats & mice, the most common indoor rodent pest problem encountered by consumers worldwide...

AeroMarine 300/21 Epoxy Resin 1.5 Gallon Kit Sale Price: $74.00   Eligible for free shipping! Availability: Usually ships in 1-2 business days See Reviews For This Product Description Clear Epoxy Resin. Total yield of 1.5 Gallons. Consists of one gallon of #300 resin and 1/2 gallons of #21 Non Blushing Cycloaliphatic Hardener. Dries clear. Our best and most popular clear epoxy resin...

J-B Non-Embedding Bore Cleaning Compound List Price: $25.99 Sale Price: $11.75 You save: $14.24 (55%)   Eligible for free shipping! Availability: Usually ships in 1-2 business days See Reviews For This Product Description Paste cleaner gets bores sparkling clean without caustic liquids. Removes lead residue in just three passes. Cushioned abrasive action actually polishes your bore clean without damage. Used and trusted by precision shooters for over 40 years to clean their finest rifle bores...