RE: Penetration testing scope/outline

From: Chuck Fullerton (chuckf69_at_ceinetworks.com)
Date: 10/06/04

  • Next message: gilles.lami_at_acr-logistics.com: "1352 tcp port" 
    To: "Anders Thulin" <Anders.Thulin@tietoenator.com>, <CraftedPacket@securitynerds.org>, <pen-test@securityfocus.com>
Date: Wed, 6 Oct 2004 09:50:12 -0400

    I had to reply to this comment.. Not trying to flame but just set the
    record straight.

    *********
    I don't know of any good online material. The OSSTMM is not a pen-test
    method, though you may be able to get useful ideas from it once
    you know what you are looking for.
    ********

    The OSSTMM stands for the "Open Source Security TESTING Methodology Manual".
    To say that it's not a pen testing method is simply incorrect. This is a
    Full methodology for ALL TYPES of Security Testing, Pen testing is a type of
    Security Testing.

    I suggest you download my whitepaper to review the different types of
    Security Testing and get an overview of the OSSTMM. You can find it at...

    http://www.securitydocs.com/library/2482

    Sincerely,

    Chuck Fullerton

    -----Original Message-----
    From: Anders Thulin [mailto:Anders.Thulin@tietoenator.com]
    Sent: Wednesday, October 06, 2004 2:35 AM
    To: CraftedPacket@securitynerds.org; pen-test@securityfocus.com
    Subject: Re: Penetration testing scope/outline

    Billy Dodson wrote:

    > Anyone have any documents they are willing to share on the scope of work
    > for a pen-test? I have looked online but was unable to find any available
    > documentation.

       The first thing is to understand the term. What's the difference
    between pen-test, red-team test, vulnerability assessment,
    security audit, etc. You will find these terms confused to a very
    great degree -- so great that I'm not even certain that you use the
    term in the same way as I do.

    > If anyone could provide me with a some links or
    > documentation outlining a pen-test/network audit it would be greatly
    > appreciated.

       So is it a pen-test you want to do or a network audit? They are
    different. I will assume pen-test.

       RFC2828 suggests that a pen-test is "a system test, often part of
    system certification, in which evaluators attempt to circumvent the
    security features of the system", but it doesn't seem to try to make a
    distinction between various types of tests, so it can be difficult to
    know just how far you can or should press this particular definition.

       The book "Hack I.T." by Klevinsky, Laliberte and Gupta (Addison-Wesley,
    2002) is the best place I know to start. It does not give the latest
    hacks, but it will give you a good overview of the job, both as to
    contents, and as to administration.

       For some of the tricks of the trade, try the "Hacking Exposed" series
    of books (Osborne/McGraw-Hill) except perhaps the J2EE & Java volume.
    Chris McNab's 'Network Security Assessment' (O'Reilly, 2004) is also useful.

       There are some books to avoid, I think ... but that may be
    something for a different thresad.

       I don't know of any good online material. The OSSTMM is not a pen-test
    method, though you may be able to get useful ideas from it once
    you know what you are looking for.

       And once you know what you mean by the term, you have to ensure that
    you understand what the customer is asking for. 

    --
Anders Thulin   anders.thulin@tietoenator.com   040-661 50 63
TietoEnator Telecom & Media AB, Box 85, SE-201 20 Malmö
----------------------------------------------------------------------------
--
Internet Security Systems. - Keeping You Ahead of the Threat
When business losses are measured in seconds, Internet threats must be
stopped before they impact your network. To learn how Internet Security
Systems keeps organizations ahead of the threat with preemptive intrusion
prevention, download the new whitepaper, Defining the Rules of Preemptive
Protection, and end your reliance on reactive security technology.
http://www.securityfocus.com/sponsor/ISS_pen-test_041001
----------------------------------------------------------------------------
---
------------------------------------------------------------------------------
Internet Security Systems. - Keeping You Ahead of the Threat
When business losses are measured in seconds, Internet threats must be stopped before they impact your network. To learn how Internet Security Systems keeps organizations ahead of the threat with preemptive intrusion prevention, download the new whitepaper, Defining the Rules of Preemptive Protection, and end your reliance on reactive security technology. 
http://www.securityfocus.com/sponsor/ISS_pen-test_041001
-------------------------------------------------------------------------------
  • Next message: gilles.lami_at_acr-logistics.com: "1352 tcp port"

    Relevant Pages

    • "How To" OSSTMM 2.5 - Penetration Testing Methodology
      ... the HOW and WHY of the OSSTMM (Open Source Security Testing Methodology ... I know you think Another Certification?! ...
      (Pen-Test)
    • RE: Pen test courses
      ... How familiar are you with ISECOM's Open Source Security Testing ... Methodology Manual (OSSTMM)? ... The OSSTMM Professional Security Tester (OPST) course picks up where the ...
      (Pen-Test)
    • RE: application security testing training
      ... techniques and apply it to their job they need to have an environment they can ask questions and be ... Someone else mentioned specialized training from CORE Security. ... >>I am looking for application security testing training, ... >>leaks, reverse engineering, writing buffer overflow exploits etc.. ...
      (Pen-Test)
    • RE: application security testing training
      ... techniques and apply it to their job they need to have an environment they can ask questions and be ... Someone else mentioned specialized training from CORE Security. ... >>I am looking for application security testing training, ... >>leaks, reverse engineering, writing buffer overflow exploits etc.. ...
      (Pen-Test)
    • Security Testing Workshop in Barcelona
      ... Security Testing Workshop in Barcelona ... the Barcelona workshop for the OSSTMM (Open Source Security Testing ... Methodology Manual) has been pushed back a week to Nov. 29th. ...
      (Bugtraq)