Penetration Testing Framework

The Penetration Testing practice involves standard outside-in testing of the sort carried out by security specialists. Penetration testing focuses on vulnerabilities in the final configuration and provides direct feeds to defect management and mitigation. Over time, the focus of penetration testing moves from trying to determine if the code is broken in some areas to a sanity check done before shipping. External penetration testers that bring a new set of experiences and skills to the problem are the most useful.

Leveraging frameworks and methodologies for offensive security assessments is a best practice to show your customers and clients you have a repeatable, professional offering. No one wants to hire or agree to an ethical hacking engagement without a plan in place that will bring value to the business. Sure there are many organizations that just want that compliance box checked off but that does not mean you need to cut corners. This post covers a list of all the known red team and threat-led penetration testing frameworks available in the industry and by various regulators. The general guide is to not reinvent the wheel but to leverage one or a few industry frameworks to create your own internal framework or methodology for performing Red Team Exercises and Adversary Emulations. It is key to ensure you use and document a framework or methodology to ensure your assessments are professional and repeatable. This is a main differentiator in a professional assessment and in offering business value.

A penetration test , colloquially known as a pen test or ethical hacking , is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system; [1] [2] this is not to be confused with a vulnerability assessment. The process typically identifies the target systems and a particular goal, then reviews available information and undertakes various means to attain that goal. A penetration test target may be a white box about which background and system information are provided in advance to the tester or a black box about which only basic information—if any—other than the company name is provided. A gray box penetration test is a combination of the two where limited knowledge of the target is shared with the auditor. Security issues that the penetration test uncovers should be reported to the system owner.

To browse Academia. Log in with Facebook Log in with Google. Remember me on this computer. Enter the email address you signed up with and we'll email you a reset link. Need an account?