A penetration test is an assessment of your network’s security, including potential vulnerabilities and how they could be exploited. Businesses and individuals perform penetration tests in order to pinpoint and correct potential ways an individual could gain access to their network. Penetration testing is similar to ethical hacking in that a trusted individual is given permission to attack a network using the same methods as those employed by an illegal hacker.
The first step in conducting a penetration test is planning. Before the testing begins, you should set out goals, time tables, and parameters. That is, determine your major concerns, decide which aspects of your network you want tested, and decide how long and when the testing will be conducted.
The second step consists of gathering information. Here is where the tester puts themselves into the shoes of an illegal hacker. Imagine you’re the hacker, and all you have is the name of a company or its website. This company is your target, and your goal now is to dig up as much information as you can to help you break into their network.
Third, the tester will manually test all of the information gathered for possible vulnerabilities. That is, they’ll pull all the hacker tricks out of their hat, so to speak, and see where and in what ways the system is vulnerable.
Last is the actual “break-in” itself. The tester starts by selecting a target. For instance, the tester could focus in on the network’s main server. From the research done during the third step, the tester has an arsenal of weapons and potential ways into the network. Now it’s a matter of using that information to hack into the targeted server.
Once the testing is complete, the tester provides the company with a report detailing the vulnerabilities and explaining how to correct them.
Exceed Security - Information Security Services::
Organizations with Internet facing systems should conduct an annual penetration test. Specifically mid to enterprise size organizations,
http://www.exceedsecurity.com/index.cfm?menu=services&submenu=pen-testHOME |
Obviously, the overarching goal of penetration testing is to uncover holes in your network security. There are, however, several different perspectives from which to approach the testing.
NETWORK PENETRATION TEST IDENTIPHI WILL CONDUCT INVASIVE TESTING ::
Buy.com has the hardware, software and computer accessories you're looking for at the right price. Whether you're looking for a new laptop and printer or
http://www.buy.com/prod/network-penetration-test-identiphi-will-conduct-invasive-testing-of/q/loc/101/203051166.htmlHOME |
Basically, your approach is determined by your answers to these two questions:
1. Who is the hacker? (Disgruntled employee? Someone with no inside information or connection to the company?)
2. How much (if any) notice/information will you give your IT staff and/or employees about the testing?
For example, if you want to know what a disgruntled employee could do, the testing will physically take place within the walls of the company, using the company’s computers and equipment. Another scenario, as mentioned above, is one where the hacker has no special access; they are simply working from their own computer and attempting to breach your network via the Internet.
The answer to the second questions determines whether, and how, you’ll involve your staff and employees. For instance, you may decide that one of your goals is to find out if your IT staff will be alerted to attempted break-ins. In that case, you would not give them any advance notice of the testing. Conversely, you could decide to have your IT staff and the penetration testers work together, focusing on a specific target.
Related to the two questions above is the issue of “zero knowledge penetration testing” versus “limited knowledge penetration testing.” With the zero knowledge approach, the testing team has been given no knowledge or information about the system and network from the company. Many consider the zero knowledge approach to be the most realistic, given that the potential attacker would be starting from scratch with regards to the hacking.
The alternative is “limited knowledge penetration testing.” This approach can save both time and money. With limited knowledge testing, the testing team is given the basic knowledge that a hacker would have come up with on their own anyway. That way, the team can move directly to the vulnerability assessment phase.
Pre-Article:The Most Attractive Places in Morocco
Next-Article:Last Minute Guide to Acing Final Exams
|
How to Conduct a Penetration Test