There are three areas to test in penetration testing: the physical structure of the system, the logical structure of the system, and the response or workflow of the system. These three areas define the scope and the types of penetration testing which are network, application, and social engineering.
Areas of Penetration Testing
Penetration Testing Areas
Network penetration testing
is an ethical and safe way to identify security gaps or flaws in the design, implementation or operation of the organization’s network. The testers perform analysis and exploits to assess whether modems, remote access devices and maintenance connections can be used to penetrate the test target.
is an ethical and safe way to identify security gaps or flaws in the design, implementation or operation of the organization’s network. The testers perform analysis and exploits to assess whether modems, remote access devices and maintenance connections can be used to penetrate the test target.
Wireless Testing If the organization has a wireless network, the following activities may be undertaken. This is not an exhaustive list, and the tester is encouraged to update the list with new testing methods. Activities include the following methods:
Web Application penetration testing
is an attack simulation intended to expose the effectiveness of an application's security controls by highlighting risks posed by actual exploitable vulnerabilities. Although organizations use firewall and monitoring systems to protect information, security can still be compromised since traffic can be allowed to pass through the firewall.
is an attack simulation intended to expose the effectiveness of an application's security controls by highlighting risks posed by actual exploitable vulnerabilities. Although organizations use firewall and monitoring systems to protect information, security can still be compromised since traffic can be allowed to pass through the firewall.
Social engineering
preys on human interaction to obtain or compromise information about an organization and its computer systems. It is used to determine the level of security awareness among the employees in the organization that owns the target system. This is useful to test the ability of the organization to prevent unauthorized access to its information and information systems. Thus, this is a test focused on the workflow of the organization.
The typical image of a penetration test is that of a team of high-tech computer experts sitting in a small room attacking a company’s network for days on end or crawling through the ventilation shafts to get into the company’s “secret room.” While this may be a glamorous image to use in the movies, in reality the penetration test works in a variety of different (and very nonglamorous) ways.
EmoticonEmoticon