Difference between revisions of "Main Page"
(disclaimer add) |
|||
| (11 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
===High Level Organization of the Standard=== | ===High Level Organization of the Standard=== | ||
The penetration testing execution standard consists of seven (7) main sections. These cover everything related to a penetration test - from the initial communication and reasoning behind a pentest, through the intelligence gathering and threat modeling phases where testers are working behind the scenes in order to get a better understanding of the tested organization, through vulnerability research, exploitation and post exploitation, where the technical security expertise of the testers come to play and combine with the business understanding of the engagement, and finally to the reporting, which captures the entire process, in a manner that makes sense to the customer and provides the most value to it. | |||
This version can be considered a v1.0 as the core elements of the standard are solidified, and have been "road tested" for over a year through the industry. A v2.0 is in the works soon, and will provide more granular work in terms of "levels" - as in intensity levels at which each of the elements of a penetration test can be performed at. As no pentest is like another, and testing will range from the more mundane web application or network test, to a full-on red team engagement, said levels will enable an organization to define how much sophistication they expect their adversary to exhibit, and enable the tester to step up the intensity on those areas where the organization needs them the most. Some of the initial work on "levels" can be seen in the intelligence gathering section. | |||
Following are the main sections defined by the standard as the basis for penetration testing execution: | Following are the main sections defined by the standard as the basis for penetration testing execution: | ||
*[[Pre-engagement|Pre-engagement Interactions]] | *[[Pre-engagement|Pre-engagement Interactions]] | ||
*[[Intelligence_Gathering|Intelligence Gathering]] | *[[Intelligence_Gathering|Intelligence Gathering]] | ||
*[[ | *[[Threat_Modeling|Threat Modeling]] | ||
*[[Vulnerability_Analysis|Vulnerability Analysis]] | *[[Vulnerability_Analysis|Vulnerability Analysis]] | ||
*[[exploitation|Exploitation]] | *[[exploitation|Exploitation]] | ||
*[[Post_Exploitation|Post Exploitation]] | *[[Post_Exploitation|Post Exploitation]] | ||
*[[reporting|Reporting]] | *[[reporting|Reporting]] | ||
As the standard does not provide any technical guidelines as far as how to execute an actual pentest, we have also created a technical guide to accompany the standard itself. The technical gude can be reached via the link below: | |||
*[[PTES_Technical_Guidelines | Technical Guidelines]] | |||
For more information on what this standard is, please visit: | |||
*[[FAQ|The Penetration Testing Execution Standard: FAQ]] | |||
Latest revision as of 20:14, 16 August 2014
High Level Organization of the Standard
The penetration testing execution standard consists of seven (7) main sections. These cover everything related to a penetration test - from the initial communication and reasoning behind a pentest, through the intelligence gathering and threat modeling phases where testers are working behind the scenes in order to get a better understanding of the tested organization, through vulnerability research, exploitation and post exploitation, where the technical security expertise of the testers come to play and combine with the business understanding of the engagement, and finally to the reporting, which captures the entire process, in a manner that makes sense to the customer and provides the most value to it.
This version can be considered a v1.0 as the core elements of the standard are solidified, and have been "road tested" for over a year through the industry. A v2.0 is in the works soon, and will provide more granular work in terms of "levels" - as in intensity levels at which each of the elements of a penetration test can be performed at. As no pentest is like another, and testing will range from the more mundane web application or network test, to a full-on red team engagement, said levels will enable an organization to define how much sophistication they expect their adversary to exhibit, and enable the tester to step up the intensity on those areas where the organization needs them the most. Some of the initial work on "levels" can be seen in the intelligence gathering section.
Following are the main sections defined by the standard as the basis for penetration testing execution:
- Pre-engagement Interactions
- Intelligence Gathering
- Threat Modeling
- Vulnerability Analysis
- Exploitation
- Post Exploitation
- Reporting
As the standard does not provide any technical guidelines as far as how to execute an actual pentest, we have also created a technical guide to accompany the standard itself. The technical gude can be reached via the link below:
For more information on what this standard is, please visit: