Overview
Penetration testing services have been on a significant increase in recent years, with most companies increasingly utilizing them to identify their system vulnerabilities. According to (Baloch 45), penetration testing is gaining popularity because of its association with a hacker’s image. (Baloch 45) adds that although penetration testing can be quite expensive in some instances, prospective buyers or target organization will still prefer to use them because of their overall perceived value. Once the hacker dissipated after the completion of the penetration testing process, the targeted organization often derive huge value from these tests and corrective solutions. Some of the solutions that might be suggested include a deep analysis of various penetration testing methods with targeted organization information technology experts.
SCOPE
According to Denis, Matthew, Carlos and Thaier (38), developing the right definition of penetration testing is very important because it helps in achieving positive results. The penetration testing scope is usually a process made up of six main aspects. First, organizations have to establish any existing security gaps because it helps in coming up with an effective action plan for reducing these threats. Moreover, Denis, Matthew, Carlos and Thaier (38) add that these tests are very important because they assist in the development of secure systems. To come up with a well-built business case, penetration tests are used because they assist in the production of security messages, especially at the implementation stage. Among the crucial penetration testing characteristics that must be considered includes discovering new threats while putting more emphasis on internal security resources. Moreover, the established regulatory requirements must also be followed because they help establish the existing weak links while providing the right validation feedback.
CHECKLIST
A penetration test cannot be a success with a well-established checklist detailing the key requirements. These requirements have to follow at least three critical phases, namely;
A. The Foot Printing Phase
B. The Enumeration Phase and,
C. The Vulnerability Analysis Phase.
Once these requirements have been met, the penetration testing criteria are then categorized as follows;
a. First, the right foot printing phase tools for the port scanner have to be identified. In this case, they include;
i. Nmap
ii. SuperScan
iii. Hping
b. Enumeration Phase-Fingerprint Tools and scanning tools must also be used in the order of the items highlighted below;
i. Xprobe2
ii. Amap
iii. Queso
iv. P0f
v. Httprint
vi. Nmap
vii. Winfingerprint
c. In regards to the tools involving the Vulnerability Analysis Phase, these vulnerability scanners listed below can be used;
i. ISS Scanner
ii. Nessus
iii. GFI LANguard
iv. Shadow Security Scanner
v. SARA
vi. Retina
THE ETHICAL CONSIDERATIONS
To ensure the established ethical standards are followed, ethical considerations play a very critical role. According to Denis, Matthew, Carlos and Thaier (34), professionalism plays a huge role in ensuring that penetration testing observes the right moral factors. As such, to Denis, Matthew, Carlos and Thaier (34) argues that providing the right evidence on professional capacity supersedes the technical skills necessary to undertake penetration testing. Moreover, developing a better understanding and accepting the right ethical practice also plays a very critical role. For this reason, it is important to ensure that the background of the tester is well assured. For example, a key EC-Council’s requirement for coming up with a certified penetration tester involves developing the right documentation where the check must return clan background checks.
In some cases, penetration testing can raise some concerns, especially in situations where ex-hackers offer their services to help compromise security systems and the testing process. As such, these penetration testers have to align properly with the established moral compass and test standards. Denis, Matthew, Carlos and Thaier (34) conclude that ensuring that these testers’ activities are closely monitored guarantees the maintenance of the right ethical standards.
References
Baloch, Rafay. Ethical hacking and penetration testing guide. Auerbach Publications, 2017.
Denis, Matthew, Carlos Zena, and Thaier Hayajneh. “Penetration testing: Concepts, attack methods, and defense strategies.” 2016 IEEE Long Island Systems, Applications and Technology Conference (LISAT). IEEE, 2016.
