Engagement Lifecycle and Risk

WEB

Can chain together separate vulnerabililties to form more complex attack chains

Industry Roles:

Assessment Methods:

Can produce proof-of-concept scripts to demonstrate issues

Industry Roles:

Assessment Methods:

Can demonstrate techniques for proving issues, which may fall outside of the constraintsand scope in place during the engagement

Industry Roles:

Assessment Methods:

Ability to identify both false postitives and false negatives and operate within the constraints of the scope of testing whilst keeping risk of disruption to an acceptable level

Industry Roles:

Assessment Methods:

Understanding and Mitigating Risk

WEB

Understands the role/function of customer emergency contacts

Industry Roles:

Assessment Methods:

Understands the importance of client confidentiality

Industry Roles:

Assessment Methods:

Understands the importance of availability and how the risk of denial of servcie can be reduced

Industry Roles:

Assessment Methods:

Understands the risks associated with a penetration test (e.g. account lockout, denial of service) and how these can be mitigated

Industry Roles:

Assessment Methods:

Understands non-disclosure agreements and complies with their requirements

Industry Roles:

Assessment Methods:

Understands the ethical issues associated with penetration testing

Industry Roles:

Assessment Methods:

Understands the impact legislation has on the penetration testing process

Industry Roles:

Assessment Methods:

Legal Matters

WEB

Awareness of sector-specific regulatory issues, Including NIS B4.d (Vulnerability management)

Industry Roles:

Assessment Methods:

Understands the legislation pertaining to penetration testing and can give examples of compliance/non-compliance. This legislation includes: computer misuse act 1990 and its amendments; Data protection Act 2018; Human Rights Act 1998; Police and Justice Act 2006; Police and Criminal evidence Act 1984; Investigatory Powers Act 2016

Industry Roles:

Assessment Methods:

Results Analysis and Presentation

WEB

Ability to classify/rank findings using numerical and /or distinct risk levels (High, Medium, Low etc) in line with how the client interprets risk within its business.

Industry Roles:

Assessment Methods:

Ability to convey both verbal and written summary of a security test to technical and non-technical audiences.

Industry Roles:

Assessment Methods:

For any given issue or group of issues, ability to convey: 1. a detailed description of the problem, 2. A list of affected components, 3. Possible sources of further information, 4. A description of the risk posed in terms of Confidentiality, integrity and Availability of the system and its data, 5. The cause of the issue, 6. Which type of attacker would most likely exploit the issue, 7. the difficulty and likelihood of a successful exploit, 8. The potential impact to the customer’s information systems and data preferably in terms of CIA, 9. Detailed recommendations for remediation, drawing upon extensive product specific knowledge where possible and providing suitable general recommendations where not (senior or principal responsibility).

Industry Roles:

Assessment Methods:

Platform Preparation

WEB

Ensures sufficient Anti-Virus software is installed and is sufficiently up-to-date

Industry Roles:

Assessment Methods:

Ensures all commercial software is suitably licenced

Industry Roles:

Assessment Methods:

Ensures all operating system and testing tools are relevant and up-to-date

Industry Roles:

Assessment Methods:

Takes steps to avoid data cross-contamination e.g. by sanitising a hard disk prior to deployment or taking an image from a master build

Industry Roles:

Assessment Methods:

Ensures all necessary hardware is available, including laptops, switches, media-converters, wireless devices and cabling

Industry Roles:

Assessment Methods:

Ability to prepare the required hardware and software for a penetration test

Industry Roles:

Assessment Methods:

Record Keeping

WEB

Keep accurate records of changes made to the systems during an assessment

Industry Roles:

Assessment Methods:

Understands how to categorise vulnerabilities with respect to recognised methodologies e.g. CVE, BID, CVSS

Industry Roles:

Assessment Methods:

Can write a report from the information gathered during a penetration test

Industry Roles:

Assessment Methods:

Understand the security requirements associated with record keeping, both during the penetration test and following the delivery fo the final report

Industry Roles:

Assessment Methods:

Understands the importance of keeping accurate and structured records during a penetration test, including the output of tools

Industry Roles:

Assessment Methods:

Understands the reporting requirements mandated by internal and external standards

Industry Roles:

Assessment Methods:

Scoping

WEB

Understand scoping in Cloud environments, and the impact of IaaS vs PaaS vs SaaS

Industry Roles:

Assessment Methods:

Understanding of the different types of testing (blackbox, whitebox, etc) and their relative advantages and disadvantages

Industry Roles:

Assessment Methods:

Understands technical, logistical, financial and other constraints and is able to take these into account without compromising the effectiveness of the penetration test

Industry Roles:

Assessment Methods:

Understands client requirements and can produce an accurate and adequately resourced penetration testing proposal

Industry Roles:

Assessment Methods:

Engagement Lifecycle

WEB

Can accurately convey the results of the penetration testing in a verbal de-brief and written report

Industry Roles:

Assessment Methods:

Can articulate the benefits a penetration test will bring to a client

Industry Roles:

Assessment Methods:

Understands penetration testing methodologies and follows these when required. These include methodologies defined by the testers’ employer, together with recognised standards, such as CHECK

Industry Roles:

Assessment Methods:

Understands the structure of a penetration test, including all relevant processes and procedures

Industry Roles:

Assessment Methods:

Understands the penetration testing lifecycle, from initial client contact, to the delivery of the final report and subsequent consultancy work

Industry Roles:

Assessment Methods:

Engagement Lifecycle and Risk

Please wait...