Let us start with the new lecture in this lecture, we are going to cover the brain testing methodologies.
The first is the all spent testing methodology, the testing is being developed as a part of the testing
project of the open Web Application Security Project.
It is not a complete methodology covering a full print listing, but it is focused only on the corporate
testing phases of the Web application security.
This guy provides a detailed discussion on the security assessment of the Web applications, as well
as the deployment stack, including Web server configuration, it follows a black box investing approach
and its comprehensive of what?
And then there are also some guides on how, mainly in the form of listing the tools which can be used
in each step and every step of prejudicing.
The main is different with the website listing the information gathering, covering exposer assessment
and deployment, fingerprinting, configuration and deployment management testing, which is assessing
the server security configuration.
The publication Securitising, which is listing a set of steps testing for specific Web apps and vulnerable,
it is much more like identify management, testing, authentication, testing, authorities investing
session management, listing, input validation, testing, testing for air handling, testing for cryptography,
business logic testing, glancey testing, which looks for vulnerabilities such as our script execution,
its Timal Allseas injection.
The website community is very active, making this methodology as one of the best Mintern Comprehensive
and UP-TO-DATE Technologies with many of print testing project nowadays, including some web apps.
The website FESTINGER is definitely you should know and you should be familiar with the website listing
are basically contains almost everything that you want best in a Web application.
The methodology is comprehensive and it's designed by some of the best researchers in the world and
open sort of security testing methodology manual or a search team and basically includes almost all
the troops in the world in a penetration test.
The methodology employed for penetration test is concise, yet it's cumbersome process which makes it
difficult to implement it in our day to day lives.
Penetration tests, despite being tedious, demands a great deal of money out of companies.
Budgets for the competition, which often are not made by large organizations or as a CMM, has been
primarily developed at a security auditing methodology assessing against regulatory and industry requirements.
It is not meant to be used as a stand alone methodology, but rather to serve as a basis for developing
one which is tailored towards the required regulations and frameworks.
Next year, I assess if methodology.
It stands for information systems security assessment framework.
The I assess if methodology is supported by the Open Information Systems Security Group, although it
is no longer maintained and therefore a bit out of date.
One of its strengths is that it links individual penda steps with penetration testing tools.
It aims to provide a comprehensive guide in conducting a apprentice and can be a good basis for developing
your own custom meterology.
I assess if breaks the testing process in the three phases planning and preparation, assessment reporting
clean up and destroy the artifacts.
The first phase is planning and preparation.
This phase is brief and only describes the steps, the exchange initial information plan and prepare
the test.
It emphasizes the need for a formal assessment agreement to sign before any testing begins.
The next phase is assessment.
This is the more useful phase is relatively detailed and even describes some of the testing tools to
be used.
Targets are described as networks whose applications and databases to some extent it is out of date
and not complete.
And the third phase is reporting this phase discusses the communication channels and types of reports
in the project, the final part of the framework is quite brief and focuses on removing any artifacts
leftover from the pen test.
It leaves the protester free to choose, like how to encrypt, sanitize and destroy data created during
the pen test.
Next is the end estimate trilogy.
The federal government developed the NIST Cybersecurity Framework in 2013 to respond to the increased
threat of cyberattacks on the critical U.S. infrastructure, including energy production facilities,
water supplies, communications systems and many more.
The backbone of the NIST framework is five core functions structure, the single and logical process.
First is the identified process to identify phase is where we develop an organizational understanding
of the risks that threaten your systems, assets and data.
Gaining this understanding requires a careful analysis of the connections between each component, documenting
how assets move through your systems and how they get accessed by the stuff.
Next is to protect the product fees is very deploy safeguards to limit the impact of potential cyber
security even and includes both digital and physical predictions.
Next is the latest.
As the name implies, dysfunction includes all the processes and procedures for detecting cybersecurity
anomalies and making sure that those events are properly understood for the response, organizations
must also implement processes to properly and quickly respond to cybersecurity even after it has been
detected, and the last is to recover.
The final function of the NIST cybersecurity methodology is to recover, which refers to the ability
to provide resilience after cyber attack and recover any capabilities or services that may have been
affected.
The NIST framework isn't the compliance standard, it was designed to guide the work of competent cybersecurity
professionals.
Unlike a compliance standard, there's no regulatory body that will verify whether your company is properly
implementing the NIST.
Nor is the standard design we followed using the NIST methodology.
In the next video, we are going to see three categories of ethical hacking.
Black box, white box and gray box.