Chapter 6 - Going Further

Abstract

Vulnerability assessment (VA) represents a key element of an organization s information security program. A VA highlights an organization's security liabilities and helps asset owners, security managers, and business leaders determine information security risk. VAs only report vulnerabilities, though. They do not substantiate that vulnerabilities actually exist; penetration tests do that. This chapter assimilates the information on tools, methodologies, and concepts that go into VA and continues with penetration testing. Penetration testing is the process of evaluating the security posture of a computer system, network, or application (assets).The process involves analyzing assets for any weaknesses, configuration flaws, or vulnerabilities. The analysis is carried out from the perspective of a potential attacker and leverages exploitation of known and possibly unknown security vulnerabilities. There are two types of penetration tests: black box and white box tests. Black box testing assumes no prior knowledge of the environment to be tested and the testers must first determine the location and extent of the assets before commencing their analysis. At the other end of the spectrum, white box testing provides the testers with complete knowledge of the environment to be tested; often including network diagrams, source code and Internet Protocol (IP) addressing information.