Microsoft® Windows® Security Resource Kit, Second Edition

Conducting Penetration Tests

Not all network administrators think like attackers or have the skill set required to break into networks. Conducting penetration tests requires you to think like an attacker. Additionally, you will need to have experience identifying weaknesses in network security, experience with tools that are used to compromise networks, and at least a basic level of expertise with one or more programming languages. If you are not confident in your abilities to think like an attacker, you should consider enlisting the help of another administrator or a consultant who is.

For a penetration test to be useful to your organization for more than just proving that weaknesses in security exist, you must carefully document your actions. ...