These
resources will help you gain a deeper understanding of penetration testing
strategies, methodologies and best practices. Many of the links also offer
insights into pressing issues that can necessitate the expansion of your
internal IT security assessment capabilities.
GENERAL
PENETRATION TESTING INFORMATION
Wikipedia Article
A high-level
definition of penetration testing:
Penetration Testing Execution Standard
A new standard designed
to provide both businesses and security service providers with a common
language and scope for performing penetration testing (i.e. Security
evaluations):
SANS Institute Penetration Testing Reading Room
A set of resources on
penetration testing trends, authored by students as part of their certification
requirements:
Penetration Testing Directory Project
An independent online
directory offering links to information on penetration testing and related
content:
Vulnerability Testing Glossary
A comprehensive index
of vulnerability and penetration testing terminology published by the
University of Oulu, Finland:
Vulnerability Assessment Portal
An information portal
for Vulnerability Analysts and Penetration Testers published by an independent
U.K.-based expert:
NETWORK
PENETRATION TESTING
National Institute of Standards and Technology (NIST)
“Special Document
800-42: Guideline on Network Security Testing”
A US
government-issued paper:
ITBusinessEdge.com
“Pen Tests Find and
Patch Network Openings”
An interview with
Mike Yaffe, director of product marketing at Core Security:
Information Systems Audit and Control Association (ISACA)
“Network Penetration
Testing”
A slide presentation
authored by Jack Jones, director of information security, Nationwide:
WEB
APPLICATION PENETRATION TESTING
SearchSecurity.com
“Web application
penetration testing: Best practices”
An overview of the
web application penetration testing process:
The Open Web Application Security Project (OWASP)
“The Evolution of Web
Application Penetration Testing”
A slide presentation
with Daniel Cuthbert:
SecurityFocus
Research article on
“Five common Web application vulnerabilities”:
Ethical Hacker Network
Informational article
on “How to Break Software”:
CLIENT-SIDE
PENETRATION TESTING
SearchFinancialSecurity.com
“Testing for
Client-Side Vulnerabilities,”
A “how-to” article on
client-side penetration testing methodology and techniques authored by Lenny
Zeltser, a leading security training expert: http://searchfinancialsecurity.techtarget.com/tip/0,289483,sid185_gci1298546,00.html
ebizQ.com
“Penetration Testing
Like a True Hacker”
A column on the need
to test client-side applications by leading security analyst, Mike Rothman:
Jacadis
“If a system is
hacked and a SIM doesn’t “hear” it, does it make a noise?”
A blog post on the
need to carry out client-side penetration testing to evaluate IT defensive
mechanisms, authored by a security consultancy:
GNU Citizen.org
“Client-side SQL
Injection Attacks”
A short essay on the ability
to exploit clients using SQL injection techniques, authored by contributors to
an information security think tank:
Usenix.org
“An Encrypted Payload
Protocol and Target-Side Scripting Engine”
A methodology for
carrying out a client-side penetration testing authored by noted researcher,
Dino Dai Zovi:
WIRELESS
PENETRATION TESTING
SANS Institute
Wireless security
training and penetration testing tutorial:
PaulDotCom Network Security Projects
Notes from a training
course on hacking wireless routers and using them in penetration tests:
WirelessDefence.org
A wireless
penetration testing framework:
PENETRATION
TESTING AND COMPLIANCE
PCI Standards Board
“Information
Supplement: Requirement 11.3 Penetration Testing”
An outline of the
penetration testing requirements for the Payment Card Industry’s Data Security
Standard:
National Institute of Standards and Technology (NIST)
“Special Document
800-53a”
A guide for assessing
security controls in federal information systems, including government
penetration testing requirements:
SearchSecurity.com
“Penetration testing:
Helping your compliance efforts”
Mike Rothman explains
why penetration testing is a critical aspect of any security program:
ITBusinessEdge
“Penetration Testing
Key to HIPAA Compliance for Care New England”
An interview with
Larry Pesce, manager, IT security, Care New England Health System:
Microsoft
“IT Showcase: Attack
and Penetration Testing”
A set of techniques
and methodologies to test compliance to security policies, and to detect
previously unknown vulnerabilities:
PENETRATION
TESTING METHODOLOGIES
InfoSec Institute
A security training
organization’s blog on practical penetration testing techniques:
The Institute for Security and Open Methodologies
(ISECOM)
“Open Source Security
Testing Methodology Manual”:
Common Criteria Web Application Security Scoring
(CCWAPSS)
A comprehensive
security scoring method for Web applications:
Information Systems Security Assessment Framework (ISSAF)
A security testing
methodology published by the Open Information Systems Security Group (OISSG):
Penetration Testing Framework
An outline for
planning assessments and gathering information relevant to the penetration
testing process:
PENETRATION
TESTING BLOGS & OPINIONS
PaulDotCom Community Blog
A security community
blog with a focus on penetration testing and an array of expert industry
contributors:
Penetration Testing Directory Project Blog
An ongoing study of
the security assessment process, industry and related issues, written by professional
pen testers:
Spylogic.net
A blog about security
and penetration testing, written by a professional pen tester:
Security Second Thoughts
A blog about
penetration testing and security research written by an independent security
consultant:
PENETRATION
TESTING TRAINING
Forward Discovery
Hacker Academy
InfoSec Institute
International Council of Electronic Commerce Consultants
iVolution Technologies
Logical Security
Mile2
PaulDotCom
SANS Institute
Security University
TrueSec
Vigilar´s Intense School
7SAFE
PENETRATION
TESTING WHITE PAPERS, PODCASTS AND OTHER RESOURCES
Penetration Testing Mailing List
A mailing list for
the discussion of issues and questions about penetration testing and network
auditing, hosted by SecurityFocus:
Seven Deadly Penetration Testing Sins
A list of security
testing no-no’s published by code analysis providers Matasano Security:
PaulDotCom Security Weekly
Videocast of the
PaulDotCom audio podcast, which covers a broad array of security and
penetration testing issues:
Security Training WebCasts
A series of expert
videocasts hosted by leading security and testing trainers from SANS Institute:
CISSP White Papers
An index of security
and penetration testing white papers maintained by training experts Logical
Security:
0 comments:
Post a Comment