SecurityFocus Penetration: RE: Penetration testing scope/outline
RE: Penetration testing scope/outline
Source: http://www.derkeiler.com/Mailing−Lists/securityfocus/pen−test/2004−10/0018.html
From: Chuck Fullerton (chuckf69_at_ceinetworks.com) Date: 10/06/04
To: "Anders Thulin"
, , Anyone have any documents they are willing to share on the scope of work > for a pen−test? I have looked online but was unable to find any available > documentation. The first thing is to understand the term. What's the difference between pen−test, red−team test, vulnerability assessment, RE: Penetration testing scope/outline 1
SecurityFocus Penetration: RE: Penetration testing scope/outline security audit, etc. You will find these terms confused to a very great degree −− so great that I'm not even certain that you use the term in the same way as I do. > If anyone could provide me with a some links or > documentation outlining a pen−test/network audit it would be greatly > appreciated. So is it a pen−test you want to do or a network audit? They are different. I will assume pen−test. RFC2828 suggests that a pen−test is "a system test, often part of system certification, in which evaluators attempt to circumvent the security features of the system", but it doesn't seem to try to make a distinction between various types of tests, so it can be difficult to know just how far you can or should press this particular definition. The book "Hack I.T." by Klevinsky, Laliberte and Gupta (Addison−Wesley, 2002) is the best place I know to start. It does not give the latest hacks, but it will give you a good overview of the job, both as to contents, and as to administration. For some of the tricks of the trade, try the "Hacking Exposed" series of books (Osborne/McGraw−Hill) except perhaps the J2EE & Java volume. Chris McNab's 'Network Security Assessment' (O'Reilly, 2004) is also useful. There are some books to avoid, I think ... but that may be something for a different thresad. I don't know of any good online material. The OSSTMM is not a pen−test method, though you may be able to get useful ideas from it once you know what you are looking for. And once you know what you mean by the term, you have to ensure that you understand what the customer is asking for.
−− Anders Thulin anders.thulin@tietoenator.com 040−661 50 63 TietoEnator Telecom & Media AB, Box 85, SE−201 20 Malmö −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−− −− Internet Security Systems. − Keeping You Ahead of the Threat When business losses are measured in seconds, Internet threats must be stopped before they impact your network. To learn how Internet Security Systems keeps organizations ahead of the threat with preemptive intrusion prevention, download the new whitepaper, Defining the Rules of Preemptive Protection, and end your reliance on reactive security technology. http://www.securityfocus.com/sponsor/ISS_pen−test_041001 −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−− −−− −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−− Internet Security Systems. − Keeping You Ahead of the Threat When business losses are measured in seconds, Internet threats must be stopped before they impact http://www.securityfocus.com/sponsor/ISS_pen−test_041001
RE: Penetration testing scope/outline
2
SecurityFocus Penetration: RE: Penetration testing scope/outline
−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
RE: Penetration testing scope/outline
3