From The Penetration Testing Execution Standard
Jump to: navigation, search
 
(20 intermediate revisions by 2 users not shown)
Line 1: Line 1:
Welcome to the Penetration Testing Execution Standard homepage. This will be the ultimate home for the penetration testing execution standard.
 
  
For more information on what this standard is, please visit:
+
===High Level Organization of the Standard===
 +
The penetration testing execution standard consists of seven (7) main sections. These cover everything related to a penetration test - from the initial communication and reasoning behind a pentest, through the intelligence gathering and threat modeling phases where testers are working behind the scenes in order to get a better understanding of the tested organization, through vulnerability research, exploitation and post exploitation, where the technical security expertise of the testers come to play and combine with the business understanding of the engagement, and finally to the reporting, which captures the entire process, in a manner that makes sense to the customer and provides the most value to it.
  
*[http://www.pentest-standard.org/index.php/FAQ The Penetration Testing Execution Standard: FAQ]
+
This version can be considered a v1.0 as the core elements of the standard are solidified, and have been "road tested" for over a year through the industry. A v2.0 is in the works soon, and will provide more granular work in terms of "levels" - as in intensity levels at which each of the elements of a penetration test can be performed at. As no pentest is like another, and testing will range from the more mundane web application or network test, to a full-on red team engagement, said levels will enable an organization to define how much sophistication they expect their adversary to exhibit, and enable the tester to step up the intensity on those areas where the organization needs them the most. Some of the initial work on "levels" can be seen in the intelligence gathering section.
  
===High Level Organization of the Standard===
 
 
Following are the main sections defined by the standard as the basis for penetration testing execution:
 
Following are the main sections defined by the standard as the basis for penetration testing execution:
*[http://www.pentest-standard.org/index.php/Pre-engagement Pre-engagement Interactions]
+
*[[Pre-engagement|Pre-engagement Interactions]]
*[http://www.pentest-standard.org/index.php/intel-gathering Intelligence Gathering]
+
*[[Intelligence_Gathering|Intelligence Gathering]]
*[http://www.pentest-standard.org/index.php/threat-modelling Threat Modelling]
+
*[[Threat_Modeling|Threat Modeling]]
 +
*[[Vulnerability_Analysis|Vulnerability Analysis]]
 +
*[[exploitation|Exploitation]]
 +
*[[Post_Exploitation|Post Exploitation]]
 +
*[[reporting|Reporting]]
 +
 
 +
As the standard does not provide any technical guidelines as far as how to execute an actual pentest, we have also created a technical guide to accompany the standard itself. The technical gude can be reached via the link below:
 +
 
 +
*[[PTES_Technical_Guidelines | Technical Guidelines]]
 +
 
 +
For more information on what this standard is, please visit:
 +
 
 +
*[[FAQ|The Penetration Testing Execution Standard: FAQ]]

Latest revision as of 20:14, 16 August 2014

High Level Organization of the Standard

The penetration testing execution standard consists of seven (7) main sections. These cover everything related to a penetration test - from the initial communication and reasoning behind a pentest, through the intelligence gathering and threat modeling phases where testers are working behind the scenes in order to get a better understanding of the tested organization, through vulnerability research, exploitation and post exploitation, where the technical security expertise of the testers come to play and combine with the business understanding of the engagement, and finally to the reporting, which captures the entire process, in a manner that makes sense to the customer and provides the most value to it.

This version can be considered a v1.0 as the core elements of the standard are solidified, and have been "road tested" for over a year through the industry. A v2.0 is in the works soon, and will provide more granular work in terms of "levels" - as in intensity levels at which each of the elements of a penetration test can be performed at. As no pentest is like another, and testing will range from the more mundane web application or network test, to a full-on red team engagement, said levels will enable an organization to define how much sophistication they expect their adversary to exhibit, and enable the tester to step up the intensity on those areas where the organization needs them the most. Some of the initial work on "levels" can be seen in the intelligence gathering section.

Following are the main sections defined by the standard as the basis for penetration testing execution:

As the standard does not provide any technical guidelines as far as how to execute an actual pentest, we have also created a technical guide to accompany the standard itself. The technical gude can be reached via the link below:

For more information on what this standard is, please visit: