Why we need Penetration Testing

1
Penetration Testing

• Need of Penetration Testing?

2
(No Transcript)
3
What is Penetration Testing ?
A Penetration Testing, or sometimes Pentest
Is a software attack on a computer system that
looks for security weaknesses,
Potentially gaining access to the computer's
features and data.
Security issues that the penetration test
uncovers should be reported to the system owner.
Penetration test reports may also assess
potential impacts to the organization and suggest
countermeasures to reduce risk.
4
Objectives / Goals of Penetration Testing are

• Determine feasibility of a particular set of
  attack vectors
• Identify high-risk vulnerabilities from a
  combination of lower-risk vulnerabilities
  exploited in a particular sequence
• Identify vulnerabilities that may be difficult or
  impossible to detect with automated network or
  application vulnerability scanning software
• Assess the magnitude of potential business and
  operational impacts of successful attacks
• Test the ability of network defenders to detect
  and respond to attacks
• Provide evidence to support increased investments
  in security personnel and technology

5
Why we need Penetration Testing Team

• There are many reasons for organizations should
  seriously consider performing penetration tests.
• A penetration test is a highly specialized,
  security-specific validation of controls in
  place.
• Penetration testing is really a form of QA that
  looks for flaws in network architecture and
  design, operating system and application
  configuration, application design, and even human
  behaviour as it relates to security policies and
  procedures.
• This can range from testing network and
  application access controls, to software code and
  IT operational processes.

6
Advantages of a Penetration Test

• Penetration testing can be extremely useful to
  people who wish to get extra reassurance when it
  comes to critical web facing systems.
• However they can also be useful in a variety of
  other ways, such as

1. Testing a System Administrator to see if he is
   keeping systems updated and secured.
2. Compliance the Payment Card Industry (PCI),
   when operating an online payments system.
3. Risk reduction and risk mitigation factors for
   insurance or other industries.
4. Protection of Confidentially, Integrity and
   Availability (CIA triad) of data.

7
Most Common Types of Penetration Tests
Two of the more common types of penetration tests
are black box and white box penetration testing.
Black Box Test,
no prior knowledge of the corporate system is
given to the third party tester. This is often
the most preferred test as it is an accurate
simulation of how an outsider/hacker would see
the network and attempt to break into it.
White Box Test, on
the other hand is when the third party
organisation is given full IP information,
network diagrams and source code files to the
software, networks and systems, in a bid to find
weaknesses from any of the available information.
8
Common Measurements for Penetration Testing
What kinds of metrics make sense for penetration
testing and vulnerability assessments?
For vulnerability assessments, common
measurements to track include

• Number of vulnerabilities found
• Criticality and types of vulnerabilities
• Percentage of systems and applications scanned
• Number of unowned or questionable assets
  detected.
• For penetration tests, the key is a baseline
• How many critical vulnerabilities were found vs.
  the last test?
• User accounts and/or passwords compromised
• Data records accessed.

9
A penetration test is useful service if your
business can justify the expense and importance
of having its web facing equipment properly
secured. Rest assured that cybercrime is a
growing problem, costing business and the
government millions each year. The cyber
criminals dont look to be giving up anytime soon
and with all this money to be made by them
online, whos to say your business wont be next?
10
Resources
http//testbytes.net/testing-services/penetration-
testing/ http//searchsecurity.techtarget.com/mag
azineContent/How-to-pen-test-Why-you-need-an-inter
nal-security-pen-testing-program http//bizsecuri
ty.about.com/od/informationsecurity/a/Penetration-
Testing-What-Is-It-Do-I-Need-It.htm
11
(No Transcript)