In the last lecture, we saw the few terms of hacking now in this lecture, we will see what is up and
testing when the assessment and vapidity.
So let's get started.
What is happening to test a penetration test is a subclass of ethical hacking.
It compromises of a set of methods and procedures that aim at testing and protecting an organization's
security.
The penetration tests prove helpful in finding penalties in an organization and check with an attacker
will be able to exploit them to gain unauthorized access to an asset penetration.
Testing is a method of evaluating the security of an information system or network by simulating an
attack to find out when the reality is that an attacker could exploit.
It exposes the gaps in the security model of an organization and helps organizations reach a balance
between technical powers and business functionality from the perspective of potential security breaches
that can help in disaster recovery and business continuity planning.
It stimulates methods used by intruders to gain unauthorized access to an organization's network systems
and then compromises them and involves using proprietary and open source tools to conduct test.
Apart from automated techniques, penetration involves manual techniques for conducting targeted testing
on specific systems to ensure that there are no security flaws that previously might have gone undetected.
So why are these tests important?
It cyberattacks becoming the norm is more important than ever before to undertake regular vulnerability
scanning and penetration testing, to identify vulnerabilities and ensure on a regular basis that cyber
controls are working.
Penetration testing looks at when the abilities and will try and to exploit them.
The testing is often stopped when the objective is achieved.
That is when an access to a network has been gained.
This means there can be other experts when it is not tested.
Organizations need to conduct regular testing of the systems for the following key reasons.
To determine the weakness in the infrastructure or applications and people in order to develop controls,
to ensure controls have been implemented and effective, this will provide assurance to information
security and senior management, then to the applications that are often the avenues of attack, that
is, people who can make mistakes despite best practices in software development and lastly, to value
system efficiency and to discover new bugs in existing software so that they can be patched and adapted
to people complaints.
The worst situation is to have an exploitable vulnerability within a company application or people that
you are not aware of as the attackers will be probing your assets, even you are not breaches unless
publicized by the attackers can go undetected for months.
And that is why carrying out frequent penetration tests are important for an organization.
Now, the next question is what is on the assessment?
That is a view.
You might have a question that in the last couple of minutes we saw that penetration testing also involves
finding out when their abilities.
But vulnerability assessment is different here.
The main goal is to figure out the vulnerabilities only we do not exploit vulnerabilities in our liberty
assessment test.
V is a process to run and identify, detect and classify the security loopholes and applications, websites,
computers, networks, information technology systems and communication systems.
I have used the word identify, detect and classify, and therefore this is the major difference between
a vulnerability assessment and a penetration testing, a minor loophole in a network can put your entire
system at risk and let all your information out.
The loopholes allow third parties to access and explicitly steal and exploit the database and information
of your entire network system.
Volatility management is the process of prioritizing, identifying, classifying and then mitigating
software vulnerabilities.
Penetration testing, however, is an active process and requires ethical hackers with profound knowledge
of networking and hacking.
Now you may get confused.
Is there any difference between the anonymity?
Because the two terminologies are often used as vapid.
But yes, there is a difference.
Oftentimes, when the assessment is confused with the penetration testing, however, those terms have
completely different meanings in a vulnerability assessment.
Our goal is to figure out all the vulnerabilities in NSW and then document them accordingly in a penetration
test.
However, we need to stimulate as an attacker to see if we are actually able to exploit that one already
and then document the findings that were exploited and the ones that turned out to be false positives.
Another differences is availability assessment is aimed at identifying known vulnerabilities in the
organization's infrastructure, whereas a penetration test, on the other hand, evaluates the security
of an asset by running a series of planned attacks.
The goal of finding an exploding when the greatest vulnerability assessment does not actually exploit
the vulnerabilities, but it identifies and considers the overall security management processes.
But in a penetration test, these vulnerabilities are exploited to see the results.
In other words, the vulnerability assessment is a part of the penetration testing process, but the
actual exploitation in the next phase of the penetration testing cycle, penetration testing is more
complete process and goes as follows, like information gathering, footprinting vulnerability assessment,
exploitation and then reporting.
So you can find that VA is actually a subset of penetration testing.
And then we'll see the different rules of engagement.
Every penetration test you do would compromise of rules of engagement, which basically defines how
open this would be laid out, what methodology would be used and start and end date, the milestones,
the goals of the penetration test, the liabilities and responsibilities.
All of them have to be mutually agreed upon by both the customer and the representative before the penetration
test is started.
So after this course, you can do a proper penetration test.
And before doing that, you must apply these rules of engagement.
So make sure you listen to these points very carefully.
The first one of the agreements, a proper permission to hack that is authorization.
And the nondisclosure agreement should be signed by both the parties.
No, you cannot directly go and hack a random website before taking prior permission in ethical hacking.
It is a common practice to take the permission first before testing any organization or website.
Scope the scope of the engagement and what part of the organizations must be tested, then the project
duration, including both the start and the end date.
The methodology to be used for conducting a penetration test, then the goals of penetration test.
Then the allowed and disallowed techniques with denial of service testing should be performed on, not
by the large scale injection should be performed or not, and much more.
Finally, the liabilities and responsibilities which are decided ahead of time as an intrusion test,
you might break into something that should not be accessible, causing a denial of service, and then
you might access sensitive information such as credit cards.
Therefore, liabilities should be defined prior to the engagement.
So make sure you follow all these points before starting a penetration test.
In the next lecture, we will see the different types of testing methodologies that are used to carry
out penetration tests in today's world.