Penetration Testing mailing list archives
Re: Penetration testing scope/outline
From: Anders Thulin <Anders.Thulin () tietoenator com>
Date: Wed, 06 Oct 2004 08:34:44 +0200
Billy Dodson wrote:
Anyone have any documents they are willing to share on the scope of work for a pen-test? I have looked online but was unable to find any available documentation.
The first thing is to understand the term. What's the difference between pen-test, red-team test, vulnerability assessment, security audit, etc. You will find these terms confused to a very great degree -- so great that I'm not even certain that you use the term in the same way as I do. > If anyone could provide me with a some links or > documentation outlining a pen-test/network audit it would be greatly > appreciated. So is it a pen-test you want to do or a network audit? They are different. I will assume pen-test. RFC2828 suggests that a pen-test is "a system test, often part of system certification, in which evaluators attempt to circumvent the security features of the system", but it doesn't seem to try to make a distinction between various types of tests, so it can be difficult to know just how far you can or should press this particular definition. The book "Hack I.T." by Klevinsky, Laliberte and Gupta (Addison-Wesley, 2002) is the best place I know to start. It does not give the latest hacks, but it will give you a good overview of the job, both as to contents, and as to administration. For some of the tricks of the trade, try the "Hacking Exposed" series of books (Osborne/McGraw-Hill) except perhaps the J2EE & Java volume. Chris McNab's 'Network Security Assessment' (O'Reilly, 2004) is also useful. There are some books to avoid, I think ... but that may be something for a different thresad. I don't know of any good online material. The OSSTMM is not a pen-test method, though you may be able to get useful ideas from it once you know what you are looking for. And once you know what you mean by the term, you have to ensure that you understand what the customer is asking for. -- Anders Thulin anders.thulin () tietoenator com 040-661 50 63 TietoEnator Telecom & Media AB, Box 85, SE-201 20 Malmö ------------------------------------------------------------------------------ Internet Security Systems. - Keeping You Ahead of the ThreatWhen business losses are measured in seconds, Internet threats must be stopped before they impact your network. To learn how Internet Security Systems keeps organizations ahead of the threat with preemptive intrusion prevention, download the new whitepaper, Defining the Rules of Preemptive Protection, and end your reliance on reactive security technology.
http://www.securityfocus.com/sponsor/ISS_pen-test_041001 -------------------------------------------------------------------------------
Current thread:
- Penetration testing scope/outline Billy Dodson (Oct 05)
- Re: Penetration testing scope/outline Jose Maria Lopez (Oct 05)
- RE: Penetration testing scope/outline Chuck Fullerton (Oct 05)
- Re: Penetration testing scope/outline josh (Oct 05)
- Re: Penetration testing scope/outline Nathan Sportsman (Oct 05)
- Re: Penetration testing scope/outline JM (Oct 05)
- Re: Penetration testing scope/outline Anders Thulin (Oct 06)
- Re: Penetration testing scope/outline robert (Oct 08)
- RE: Penetration testing scope/outline Chuck Fullerton (Oct 08)
- Re: Penetration testing scope/outline Anders Thulin (Oct 08)
- RE: Penetration testing scope/outline Chuck Fullerton (Oct 08)
- RE: Penetration testing scope/outline Tate Hansen (Oct 08)