Käyttäjä:ApplewhiteDrees762
Security penetration testing is an essential part of any organisation's information security provision. However many security controls you implement for the data, you will never be sure how effective they're until you actively test them out by commissioning security penetration testing (also referred to as "pen testing").
In the course of security penetration testing, the tester will probe your organisation's computer and network defences, and will then make an effort to breach them (with your permission), but without resulting in the damage that the malicious hacker may cause. The outcomes are explained in a report that also includes recommendations for actions to correct any security loopholes inside your systems.
To get the very best from the test results, you should be aware of the general pattern taken with a penetration test. This makes it possible to make sure that your provider is following the correct methodology. The main stages are listed below:
- Foot-printing: Public sources of information are used to gather information about your organisation's Internet presence.
- Scanning: Standard tools are used to map your network inside a non-intrusive way, determining the amount of computers and the network configuration.
- Enumeration: This stage involves attempting active connections to your systems in order to discover information (for example valid account names) that could be exploited by hackers. This stage and also the two preceding stages are all legal: the further stages would not be legal without your organisation's written permission.
- Gaining access: This is the point where security penetration testing makes its very own, because the test demonstrates whether a hacker could gain access to your network.
- Increasing access rights: Having gained access, the pen tester now seeks to increase his/her access rights to the highest level possible, in order to find out whether your network is susceptible to this kind of "exploit". A hacker who succeeds in gaining high-level access could wreak considerable damage on the systems.
- Pilfering and theft of information: Getting into a much more active mode, the safety penetration testing procedure now covers the attempted theft of knowledge.
- Covering one's tracks: An experienced pen tester will attempt to cover his/her tracks so that the attack remains undetected, in order to demonstrate this can be done, since a stealth attack is the most dangerous kind.
- Creating a mystery: A further refinement is to produce a "back door" that can make it easier to access your systems in the future. When the penetration tester finds this is possible, it'll easily be highlighted within the report as a major weakness of your systems.
- Denial of service: Finally, the tester may seek to discover whether a "denial of service" attack is possible, whereby resources become unavailable to legitimate users.
You should observe that the more active phases of testing may disrupt the normal operation of networks, resulting in some denial of service. For this reason, some organisations like the security penetration testing to stop lacking those stages. Each pen testing project ought to be included in a particular contract aiming exactly what will or will not be attempted. In general, penetration testing ought to be carried out at regular intervals, and certainly after major changes to the pc network. Used correctly, pen tests is definitely an indispensable aid to your organisation's information security management system.
