Penetration Testing Process Overview

Study Notes

Penetration Testing Process

The penetration testing process consists of six steps
The goal is to identify security vulnerabilities, test security policies, and evaluate an organization's ability to respond
The steps include:
- Determining the objectives and scope
  - This includes identifying security weaknesses, testing security policy compliance, and testing the organization's ability to respond to security incidents
- Choosing the type of test
  - Common types of penetration testing include:
    - Black-Box testing: Simulates a real-world attack with limited knowledge about the target organization
    - Grey-Box testing: The penetration tester has some limited knowledge of the target, such as the operating system used
    - White-Box testing: The penetration tester has full knowledge of the target, simulating an "insider attack"
- Gaining permission via a contract
  - This step involves getting written authorization to perform the test
  - The written authorization should include:
    - Systems to be evaluated
    - Perceived risks
    - Timeframe
    - Actions to be performed when a serious problem is found
    - Deliverables
- Performing penetration testing
  - The core part of the penetration testing process, this involves a series of steps to identify vulnerabilities
- Creating a Risk Mitigation Plan (RMP)
  - The RMP outlines options and actions to enhance opportunities and reduce threats
  - The RMP should clearly document all actions taken and results
- Cleaning up any changes made during the test
  - It involves reversing any changes made during the penetration testing process

The CIA Triad and Anti-CIA Triad

The CIA (Confidentiality, Integrity, Availability) triad represents key security goals
Confidentiality refers to keeping information secret from unauthorized individuals
Integrity refers to maintaining the accuracy and completeness of information
Availability refers to ensuring information and assets are accessible to authorized users
The Anti-CIA triad represents threats to the CIA triad
Improper disclosure refers to accidental or malicious revealing of information
Unauthorized altercation refers to accidental or malicious modification of information
Disruption refers to accidental or malicious disturbance of information or resources

Intelligence Gathering in Penetration Testing

Intelligence gathering involves ethical hacking techniques to locate information about a target organization
The information gathered can help refine later steps of the penetration test
The process involves seeking any exploitable data to gain an advantage
"Luck" can play a role in finding valuable information
Consequences of intelligence gathering can include business or reputation loss if customer data is not properly secured

Secure Business Transactions and Backup Information

It is important to use secure browsers for online activities to protect data
Regularly deleting temp files, cookies, history, and saved passwords is also recommended
Backing up important information is crucial
Backups should be:
- Recent
- Off-site and secure
- Documented
- Encrypted
- Tested

Defining Penetration Testing

The term "hacker" has different meanings
A hacker can be someone who gains unauthorized access to data
It can also refer to a skilled computer programmer or user
There are different types of hackers:
- White Hat hackers: Ethical hackers working for the good, adhering to a code of ethics
- Grey Hat hackers: Hackers operating on the line between good and bad sides
- Black Hat hackers: Hackers operating on the wrong side of the law, potentially with malicious intentions
- Cyberterrorists: Hackers attempting to cause destruction and harm, sometimes without stealth
A penetration tester is a white hat hacker employed to conduct penetration tests
Penetration testing involves surveying, assessing, and testing the security of an organization using techniques and tools similar to black hat hackers
Ethical hacking is often used as a synonym for penetration testing