Penetration Testing: Protecting Networks and Systems

Penetration Testing: Protecting Networks and Systems

by Kevin M. Henry
Released June 2012
Publisher(s): IT Governance Publishing
ISBN: 9781849283731

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Preparation for the Certified Penetration Testing Engineer (CPTE) examination

Penetration testing is the simulation of an unethical attack of a computer system or other facility to prove how vulnerable that system would be in the event of a real attack. The Certified Penetration Testing Engineer (CPTE) examination provides a widely recognized certification for penetration testers.

The fundamentals of penetration testing

This book is a preparation guide for the CPTE examination, yet is also a general reference for experienced penetration testers, ethical hackers, auditors, security personnel and anyone else involved in the security of an organization's computer systems.

Key areas covered include:

  • The primary phases of pen testing – reconnaissance, enumeration, vulnerability assessment and the eventual launch of an attack.
  • The preparation of the test report – what information to include in the report and how best to present it to the client.
  • The introduction of new technology ­– how it can improve business operations (e.g. employee remote access, wireless communications, public-facing web applications), but, at the same time, create new vulnerabilities.

Focusing on the techniques

This book avoids a detailed analysis of the tools currently used by today's pen testers, which often come in and out of fashion, and, instead, focuses on the range of techniques employed by professional pen testers around the world.

The author draws on his wealth of experience and provides real-world examples to illustrate the most common pitfalls that can be encountered during both the testing phase and also when delivering the final report.

A successful penetration test not only discovers the vulnerabilities of a system but also determines the level of risk that those vulnerabilities pose to the organization. Readers of this book will gain a better understanding of how to conduct a penetration test, and also how to deliver a client-focused report that assesses the security of the system and whether the level of risk to the organization is within acceptable levels.

Who should read this book?

This book should be read by many, including Penetration Testers, or those studying for the CPTE Exam and Ethical Hackers. Penetration testing is an essential component in any ISO27001 ISMS – so Auditors, Security Officers and Security Personnel should also read this book to understand the vital role Penetration Testing plays in protecting organisations from cyber attacks.

A business-aligned approach to penetration testing - Better defend your systems, intellectual property and values with this essential guide!

"

Table of contents

  1. Cover
  2. Title
  3. Copyright
  4. Preface
  5. About The Author
  6. Acknowledgements
  7. Contents
  8. Introduction
  9. Chapter 1: Introduction to Penetration Testing
    1. Case study
    2. Security basics
    3. Risk management
    4. The threat environment
    5. Overview of the steps to penetration testing
    6. Penetration testing versus hacking
    7. Benefits of penetration testing
    8. Summary
    9. Key learning points
    10. Questions
  10. Chapter 2: Preparing to Conduct a Penetration Test
    1. Approval and scope
    2. Planning
    3. Summary
    4. Questions
  11. Chapter 3: Reconnaissance
    1. The start of the test
    2. Physical information gathering
    3. Other data sources
    4. Avoiding footprinting
    5. Key learning points
    6. Questions
  12. Chapter 4: Active Reconnaissance and Enumeration
    1. Port scanning
    2. Countermeasures to active reconnaissance
    3. Key learning points
    4. Questions
  13. Chapter 5: Vulnerability Assessments
    1. The attack vectors
    2. References and sources of vulnerabilities
    3. Using vulnerability assessment tools
    4. PCI DSS requirements
    5. Malicious code
    6. Reporting on the vulnerability assessment
    7. Key learning points
    8. Questions
  14. Chapter 6: Hacking Windows® and UNIX
    1. Having fun
    2. Common hacking initiatives
    3. Defeating data theft
    4. Protecting against unauthorized access
    5. Access controls
    6. Actions of the attacker
    7. Focus on UNIX/Linux
    8. Advanced attacks
    9. Source code review
    10. Case study: Attack on a Chinese bank
    11. Key learning points
    12. Questions
  15. Chapter 7: Launching the Attack
    1. Steps to an exploit
    2. Attacking wireless networks
    3. Pen testing wireless
    4. Network sniffing
    5. Firewalls
    6. Intrusion detection and prevention systems (IDS/IPS)
    7. Key learning points
    8. Questions
  16. Chapter 8: Attacking Web Applications
    1. The steps in attacking a web application
    2. Questions
  17. Chapter 9: Preparing the Report
    1. Determining risk levels
    2. Risk response
    3. Report confidentiality
    4. Delivering the report
    5. Key learning points
    6. Questions
  18. Appendix 1: Linux
  19. Appendix 2: Encryption
    1. Concepts of cryptography
  20. Appendix 3: Regulations and Legislation
    1. Examples of regulations and legislation
    2. Protection of intellectual property
  21. Appendix 4: Incident Management
    1. Concepts of incident management
  22. Additional Questions and Answers
    1. Answers
  23. References
  24. ITG Resources

Product information

  • Title: Penetration Testing: Protecting Networks and Systems
  • Author(s): Kevin M. Henry
  • Release date: June 2012
  • Publisher(s): IT Governance Publishing
  • ISBN: 9781849283731