So now when it comes to information security testing, the infrastructure of an organization is really
important.
So in this lecture, we are going to talk about some vulnerability assessment techniques.
The first is security testing and evaluation.
Now, the main goal of security testing and evaluation is to identify the threats that are present in
the system.
And you can measure the potential vulnerabilities that have been existing in the system so that the
team can then patch them.
Now, security testing and evaluation is another technique that can be used in identifying the information
and communication systems vulnerabilities during the risk assessment process.
Now it includes the development and execution of the test plan, test case test scripts, test procedures
and expected results.
Now, the purpose of system security testing is to test the effectiveness of the system.
How effective is is the system against different cyber threats and mostly security testing and evaluation?
S.A.G. is for ICT systems that is in information and communication technology ICT.
Now, the objective of this air security testing and evaluation is to ensure that the applied controls
need the approved security specification for the software and hardware and implement the organization's
security policy or meet the industry standards.
This is the main reason of security testing and evaluation, which is a first technique that we have
seen under vulnerability assessment.
Now, the next technique that we are going to see is penetration testing.
I hope many of you have heard the term penetration testing.
While learning ethical hacking or cybersecurity, this is very common in today's companies, so you
can see the testing here has external bank testing, blind bank testing, internal bank testing, and
the penetration testing can be carried out on network services to wireless glines of applications and
much more so now.
Penetration testing can be used to complement the review of security controls and ensure that different
facets of the ICT system are secured.
Bank testing, also known as penetration testing of and used in the risk assessment process, can be
used to assess and system's ability to withstand intentional attempts to circumvent the system security.
Now, let me tell you people, the main objective of bank testing is to test the system from the viewpoint
of a third source, which means when it comes to bank testing, the one who is going to test the system
acts like he's the hacker and he's trying to hack the system.
But he's an ethical hacker and he's being paid by the company to test the system.
Now, to exploit it is important to know that to exploit a particular vulnerability, one needs to know
the exact system and applications that are being tested on the system.
Also, it is important to note that penetration testing tools and techniques can give false positives
as well because they are automated tools.
And unless and until someone are an expert, ethical hacker verifies manually that the vulnerability
is present.
We cannot be so sure of, you know, telling the organization that the system is vulnerable.
For example, if an automated system tells us that its clinician is present and if you directly writing
the report, but the organization's own hacker finds out that there is no such vulnerability present,
then, you know, there's that that's a bad practice.
So what generally people do is they implement automated tool to gather the results and then they test
each test case against the system to actually verify the existence of the vulnerability.
In such case that tested objects should be considered vulnerable as well.
Now, when it comes to pain testing, there are three types of penetration tests black box, white box
and gray box in black box.
The hacker or the ethical hacker particularly has no knowledge about the system that he's going to hack.
It is completely a blind box and he has no information.
He's just given the IP address of the target system and he's about to hack.
When it comes to white box.
The ethical hacker has a good knowledge of the security infrastructure.
He knows the firewalls where they are pleased.
What is the address of the firewalls?
What are the techniques implemented to avoid single injection then the usernames and passwords of the
default account.
He knows everything, and when it comes to box, some information might be revealed and some may be
hidden in order to test the security infrastructure.
But if you ask me personally, the best way of testing is the black box being distinct because most
of the ethical hackers or most of the cyber attacks that take place are in the case of black box because
the hackers do not know about the security organizations infrastructure.
And that is why having a black box and testing is really important.
But also make sure that you understand that black box testing takes a huge amount of time to discover
vulnerabilities as compared to white box.
So this was it.
When it comes to security assessment and testing, I hope you understood the fundamental concept of
bank testing and now in the next lecture will talk about a threat.
What is the definition of threat?
And we will also see that different types of threats, spooky students.
So one more thing before we move on to the next lecture, as you can see, that is cybersecurity has
become very important and there are many courses charging a lot of money that actually are secure as
it is doing our best quality education with minimal amount.
Or some of you may have a significant role.
Now, as a team, we need support and we need your motivation.
So what we expect from you is just a simple routine.
If need not be a five star review on anything, you're not going to tell.
It's your choice if you want to give it a five star full stop.
I'm not I'm not one to instruct, but.
A review from this really keep us motivated.
So many of you actually have questioned me how to get.
So now I'm going to show you how do you need to write a review for the girls?
So as it you need the reading is a good is option so you can click here.
And how would you read the script?
I want you to please honestly give me your feedback, because your feedback is very valuable to us and
we will try our best to give more interesting content in every month.
So I'm going to select Firestar because I am very proud of myself that I am doing some good for the
community by doing this.
So just tell us about your personal experience.
Was it a good match for you?
You can write anything or you can just write it as a coach.
Go see people who really need you to support us because we are working days and nights to drop and record
this video.
So all you can do is just give us everything you can even it's your choice of to give the number of
it.
So save and continue and you can select this option, but it's optional.
You can just skip.
So I that everything else, because I think I'm delivering the course point save and continue and that's
it.
I'm not going to repeat myself.
I'm not going to give you the count.
It's faulty information security purpose, of course.
Yeah.
So Steve.
And that is it.
Students, we are just expecting a small preview from you.
Please help us and please support us.
But I think that if you let us start with the next.