From The Penetration Testing Execution Standard
Jump to: navigation, search
Line 1: Line 1:
Welcome to the Penetration Testing Execution Standard homepage. This will be the ultimate home for the penetration testing execution standard.  
+
Welcome to the Penetration Testing Execution Standard homepage.
  
For more information on what this standard is, please visit:
 
 
*[[FAQ|The Penetration Testing Execution Standard: FAQ]]
 
  
 
===High Level Organization of the Standard===
 
===High Level Organization of the Standard===
*Note: This is the BETA RELEASE. We have had TONS of interest from many members of the security community to help out and we wanted to show where we were at. This effort has been going on since November 2010 and has had over 1800 revisions. The links below are a basic view into where we are at today.
+
The penetration testing execution standard consists of seven (7) main sections. These cover everything related to a penetration test - from the initial communication and reasoning behind a pentest, through the intelligence gathering and threat modeling phases where testers are working behind the scenes in order to get a better understanding of the tested organization, through vulnerability research, exploitation and post exploitation, where the technical security expertise of the testers come to play and combine with the business understanding of the engagement, and finally to the reporting, which captures the entire process, in a manner that makes sense to the customer and provides the most value to it.
 
 
'''What we are looking for out of this release:'''
 
 
 
-Gain help from people who understand the direction of the map and will be willing to document the methods used to carry out the tasks identified in the branches
 
 
 
-Take feedback and comments form the community on improvements
 
 
 
-Identify the next phase in terms of defining "levels" for each of the sections.
 
 
 
-Create teams to tackle writing our the formal standard
 
 
 
-Create tools to address the gaps identified during the creation of the Standard
 
 
 
-And most of all, put an end to the poorly defined term Penetration Test!
 
 
 
 
 
-Added Content
 
-Weighting system
 
-Grading Structure
 
-Sample contracts
 
-Sample deliverables
 
-PTES Adaptive Strength questionnaire
 
-tons more...
 
  
 +
This version can be considered a v1.0 as the core elements of the standard are solidified, and have been "road tested" for over a year through the industry. A v2.0 is in the works soon, and will provide more granular work in terms of "levels" - as in intensity levels at which each of the elements of a penetration test can be performed at. As no pentest is like another, and testing will range from the more mundane web application or network test, to a full-on red team engagement, said levels will enable an organization to define how much sophistication they expect their adversary to exhibit, and enable the tester to step up the intensity on those areas where the organization needs them the most. Some of the initial work on "levels" can be seen in the intelligence gathering section.
  
 
Following are the main sections defined by the standard as the basis for penetration testing execution:
 
Following are the main sections defined by the standard as the basis for penetration testing execution:
Line 41: Line 16:
 
*[[reporting|Reporting]]
 
*[[reporting|Reporting]]
  
We welcome comments on all the sections, and have an online version in PDF which we have opened for collaboration [https://acrobat.com/?i=huOmLeHWM9cHJHnfGCI9Lg here].
+
As the standard does not provide any technical guidelines as far as how to execute an actual pentest, we have also created a technical guide to accompany the standard itself. The technical gude can be reached via the link below:
 +
 
 +
*[[PTES_Technical_Guidelines | Technical Guidelines]]
  
Below is the Penetration Testing Execution Standard Guidelines:
+
For more information on what this standard is, please visit:
  
*[[PTES_Technical_Guidelines | Technical Guidelines]]
+
*[[FAQ|The Penetration Testing Execution Standard: FAQ]]

Revision as of 20:14, 16 August 2014

Welcome to the Penetration Testing Execution Standard homepage.


High Level Organization of the Standard

The penetration testing execution standard consists of seven (7) main sections. These cover everything related to a penetration test - from the initial communication and reasoning behind a pentest, through the intelligence gathering and threat modeling phases where testers are working behind the scenes in order to get a better understanding of the tested organization, through vulnerability research, exploitation and post exploitation, where the technical security expertise of the testers come to play and combine with the business understanding of the engagement, and finally to the reporting, which captures the entire process, in a manner that makes sense to the customer and provides the most value to it.

This version can be considered a v1.0 as the core elements of the standard are solidified, and have been "road tested" for over a year through the industry. A v2.0 is in the works soon, and will provide more granular work in terms of "levels" - as in intensity levels at which each of the elements of a penetration test can be performed at. As no pentest is like another, and testing will range from the more mundane web application or network test, to a full-on red team engagement, said levels will enable an organization to define how much sophistication they expect their adversary to exhibit, and enable the tester to step up the intensity on those areas where the organization needs them the most. Some of the initial work on "levels" can be seen in the intelligence gathering section.

Following are the main sections defined by the standard as the basis for penetration testing execution:

As the standard does not provide any technical guidelines as far as how to execute an actual pentest, we have also created a technical guide to accompany the standard itself. The technical gude can be reached via the link below:

For more information on what this standard is, please visit: