Let's now look at some of the processes for penetration testing.
While we may think that penetration testing is all about breaking into systems,
that's only one part of the process associated with professional
penetration testing. Without a standard guiding the testing,
the results were sloppy and ineffective assessments.
Customers had reports that could not help them evaluate
the true state of their security.
There was inconsistent execution amongst the various penetration
testers and insufficient value delivered to the customer.
A standard of practice was needed.
Recognizing this need,
a group of testers came together to collaboratively create
a standard for penetration testers called The Penetration
Testing Execution Standard.
Twenty industry professionals have contributed to the standard so far.
It's not a formal standard,
but its value lies in the collection and organization of information
relevant to pen testers as well as penetration test customers.
If you're considering a career as a penetration tester,
I would suggest that you spend some time with the PTES. It will give you a
good idea of what's expected from penetration testers.
The standard is organized into seven sections that cover the approximate
timeline for a penetration test from start to finish.
The first section covers the pre‑engagement work. Before testing begins, the
customer describes their objectives of testing, the scope of the effort, and
defines the targets of the test. A contract, the rules of engagement, and the
lines of communication are also established.
Intelligence gathering is the next step in the standard.
These are activities associated with discovering
more information about the client.
This information is useful for later phases of testing.
Threat modeling uses the business asset and business process information
gathered about the client to analyze the threat landscape. Based on
target information, the threats and threat agents can be identified and
mapped to the asset information.
The result is a model of the threats that an organization is likely to face.
Vulnerability analysis is about finding flaws and weaknesses. Through a
variety of testing methods and tools, the tester gathers information about
the systems in use and their vulnerabilities.
Using the collected vulnerability information,
the tester can attempt to exploit some of those
vulnerabilities to gain access to the targets.
Some target systems have security controls that the
tester will attempt to bypass, disable, or avoid.
Once the tester has successfully gained access to a system,
she needs to determine if it has any valuable data or access to other systems.
The post‑exploitation phase explores these techniques.
Finally,
the tester reports findings back to the client. Remember, the goal
of a penetration test is to help the client improve their security
posture through the remediation of any significant weaknesses
discovered during testing.