- One of the most popular standards or methodologies
is the Penetration Testing Execution Standard.
You can access the details about the standard
at the website that I'm showing in the screen.
The Pen Test Execution Standard
is divided into seven main sections.
They cover everything related to the penetration testing.
So starting from the initial communication
and even why you will do a pen test,
and all the pre-engagement interactions and scoping,
so things on how to develop statement of work or an SOW.
They also cover the rules of engagement.
They go over how to define a scope,
and what is important
within your penetration testing engagement.
Then they actually go into
the intelligence and gathering phase,
and then threat modeling.
And that's where you get a better understanding
of systems and the organization
that you're actually performing the pen test.
Then you move into the vulnerability analysis, exploitation,
and post-exploitation phases.
Now, at the end of engagement,
you create a pen test report,
which is actually one of the most important deliverables
that you can actually do to your customer,
or whoever tasked you to perform the assessment.
Now, NIST also published a guide
on how to conduct security assessments.
The document is the Special Publication 800-115.
So 800-115.
It is pretty similar to the methodology
described in the Pen Testing Execution Standard,
but in this case they actually have four major phases.
They basically actually cover the same
as in the seven phases of the pen test standard.
Now this methodology starts with a planning
and then discovery, attack, and at the end, reporting.
Notice that the planning phase
has a direct arrow pointing to the reporting.
And this is because the planning phase
allows you to even discuss
on how the penetration testing report will be structured
and how it will be delivered,
and your client or the person that actually tasked you
to do the penetration testing
can actually have specific requirements
or things that they want to include in that report.
You can also see a feedback loop between the discovery phase
and the attack phase.
This is because depending on the things that you compromise
or exploit during the penetration testing engagement,
you may actually have to go back
and gather more intelligence and information
to carry out further attacks.
Now, an organization that actually is amazing
whenever it comes to web application security
and security as a whole, is the OWASP organization.
And they also have a security testing guide
that is extremely detailed.
So if you're not familiar with OWASP,
I highly recommend that you become familiar with them.
OWASP stands for Open Web Application Security Project,
and it's an international organization and an open community
dedicated to enabling organizations
to learn more about application security.
All of the OWASP tools, the documents, white papers, forums
and even local chapters are actually free and open
to anyone interesting in improving application security.
So one thing that I will advise you
is to become familiar with this organization,
but also see if in your region,
depending on where you're listening from,
you may actually have an OWASP local chapter.
So that allows you to, of course,
interact with other security professionals
and also to contribute to this collection of resources.
At the end of the day, when it comes to application testing
or web application security testing,
you may be doing a general assessment
of an infrastructure,
where you will encounter several applications and systems
that you actually have to test,
but you also can be hired just to perform other tests
such as wireless infrastructure assessment
or network infrastructure assessments, and many others.
However, in many instances,
you may also be hired just to test one application
or a set of applications, depending on the scope.
So especially around a compliance, you may be tasked
to only look at a specific area of the network
where some specific applications may actually reside.
This is where the scope comes into place.
So having a good and adaptable process and methodology
is key to the success of your engagement.