ECSA: Penetration Testing Procedures & Methodologies [azazredhat]

The Security Analyst Series from EC-Council | Press is comprised of five books covering a broad base of topics in advanced penetration testing and information security analysis. The content of this program is designed to expose the reader to groundbreaking methodologies in conducting thorough information security analysis, as well as advanced penetration testing techniques. Armed with the knowledge from the Security Analyst series, along with proper experience, readers will be able to perform the intensive assessments required to effectively identify and mitigate risks to the security of the organization's infrastructure.

This book discusses the various penetration testing training techniques, strategies, planning, scheduling, and also frames a guideline that a penetration tester can adopt while performing a penetration test. This book also discusses the various test agreements that depict the outline of the test being performed.

Course Briefing:-

1.Penetration-Testing Methodologies
Module Brief:
Penetration testing goes a step ahead of vulnerability scanning in security assessment. Unlike vulnerability scanning which examines the security of individual computers, network devices, or applications, penetration testing assesses the security model of the network as a whole.
This module discusses in detail about the need of penetration testing, common penetration testing techniques and frames a guideline that a penetration tester can adopt while performing a penetration test. The module discusses various penetration testing methods and strategies for penetration testing.


2.Customers and Legal Agreements
Module Brief:
Various customer requirements need to be identified and the objectives of the penetration test should be developed in relevance to those requirements. “Rules of Behavior” is a test agreement that depicts the outline of the test being performed. It explains in detail the internal and external aspects surrounding the testing procedure. Before the test is performed, authorized representatives from both the parties have to sign this agreement.
This module deals with various legal agreements of penetration testing, the need for penetration testing, stages of penetration testing, customer requirements, rules of behavior, and risks associated with penetration testing.


3.Duties of a Licensed Penetration Tester
Module Brief:
“Rules of Engagement” is the formal permission to conduct a pen-test. It provides certain rights and restriction to the test team for performing the test and helps testers to overcome legal, federal, and policy-related restrictions to use different penetration testing tools and techniques.
This module discusses the Rules of Engagement (ROE), the scope of ROE, steps in framing of ROA, and the clauses in an ROE.


4.Penetration-Testing Planning and Scheduling
Module Brief:
A penetration test plan is a part of an overall security plan and sets the ground rules for the test. The important part of the penetration test plan is to improve the test ground rules. The goal of the penetration testing is to focus on developing adequate evidence of flawlessness and to reach a security assurance level.
This module explains the purpose of a test plan, building a test plan, penetration testing planning phase, test teams, testing project plan, and the various penetration testing project scheduling tools.


5.Pre–Penetration Testing Checklist
Module Brief:
This module briefs the list of steps that should be taken before starting a penetration test.


6.Information Gathering and Social Engineering Penetration Testing
Module Brief:
This module familiarizes with details in information gathering phase such as newspaper cuttings, articles, websites, notes, papers, photos, snapshots, email messages, letters, documents, napkins with data, CD-ROMs and DVD, floppy disks, tapes, zip drives, USB disks, handwritten notes, employee signatures, employee writing style, and grammar syntax
The term social engineering is used to describe the various techniques used to trick people (employees, business partners, or customers) into voluntarily giving away personal information that would not normally be known to the general public. Attackers are always looking for new ways to access information. They ensure that they know the surroundings and certain people in an organization like security guards, receptionists, and help desk workers.
This module also discusses the various steps and methods for gathering information about the potential victim. It also showcases various spy gadgets that aid the attacker in gathering information.


7.Vulnerability Analysis
Module Brief:
This module familiarizes with vulnerability assessment training and types of vulnerability assessment that can be used to identify weaknesses that could be exploited and test the effectiveness of additional security measures taken to defend attacks.
This module also tells how time management scheduling of a task is important and also explains in detail about various vulnerability assessment tools.


8.External Penetration Testing
Module Brief:
This module discusses External Intrusion Test and Analysis as a process of determining the security flaws and strengths of the client systems. It also familiarizes with various steps involved in external penetration testing and scan for default ports of various services which are vulnerable.


9.Internal Network Penetration Testing
Module Brief:
This module provides internal network penetration testing and various methods like port testing and vulnerability testing. It also explains sniffing with various sniffing tools.


10.Penetration-Testing Deliverables
Module Brief:
Documentation writing plays a major role in penetration testing process. The documentation report prepared should contain the details of the final test results and recommendations to rectify the problems that might be found during the test process.
This module explains the structure of the documentation report which should include-“Summary of the test execution”, “Scope of the project”, “Result analysis”, “Recommendations”, “Appendices”. It also discusses about the test reports on a network such as executive report, active report, and host report, vulnerability report, creating and writing the final report, report format, delivery and retention.


11.Post-testing Actions
Module Brief:
In post penetration testing, the first focus is on high-priority security worries.
This module discusses how to adopt technical solutions for the originated security issues, developing strategies to achieve short-term and long-term security postures, and deciding on the required and available resources to maintain reliable information security.


12.Advanced Exploits and Tools
Module Brief:
This module discusses in detail the common vulnerabilities. It also tells the anatomy of an exploit and what a typical overflow is. This module explains the strengths and uses of payload generators and exploitation tools including: GDB, Metasploit, Canvas, CORE Impact M.B.S.A, NSAT, and Network Security Inspector.

About the Author:-

The International Council of E-Commerce Consultants (EC-Council) is a member-based organization that certifies individuals in various e-business and security skills. It is the owner and developer of the world famous Certified Ethical Hacker course, Computer Hacking Forensics Investigator program, License Penetration Tester program and various other programs offered in over 60 countries around the globe. These certifications are recognized worldwide and have received endorsements from various government agencies including the US Federal Government via the Montgomery GI Bill, and the US Government National Security Agency (NSA) and the Committee on National Security Systems (CNSS) certifying EC-Council Network Security Administrator (ENSA) program for meeting the 4011 training standard for information security professionals.

Product Details:-

Paperback: 256 pages
Publisher: Course Technology; 1 edition (May 4, 2010)
Language: English
ISBN-10: 1435483677
ISBN-13: 978-1435483675
Product Dimensions: 10.7 x 8.5 x 0.7 inches