Penetration Testing Execution Standard (PTES) (Part 1 of 2)

By Ashwin Venugopal -

 







Introduction

Nowadays, cyberattack on various organizations, enterprises, or government sectors via hacktivists, criminals, national enemies, etc. have become a common practice. They always look for a loophole to penetrate a computer network's defense system of their victims. Hence, there are many effective ways to defend against cyber attacks. Some of them are- training the employees, keeping the system and software up-to-date, multiple backup solutions, monitoring network traffic, etc. However, one of the major defense mechanism is PTES (Penetration Testing Execution Standard). 

What is PTES?

PTES is basically a comprehensive guide that outlies a standard methodology for conducting penetration tests. The method was developed by a team of information security practitioners to cater to the need of a complete and updated standard for penetration testing. 

Penetration testing is a process in which organizations can test their own network security by simulating the real-world cyberattacks. This process helps in locating and fixing any vulnerabilities before their exploitation by a threat actor. PTES always strives to raise the standard for penetration testing quality and offer high-caliber advice and help guide to the penetration tester. 

Process of PTES

PTES segregates the testing process in seven sections:
  • Pre-engagement Interactions- This is the preparation phase. Everything is decided by the client and the penetration testing body before starting the actual process. Things like scope, information supplied to the body, and rules of engagement are discussed beforehand. Also, the goals of the penetration test are made crystal clear to everyone.

  • Intelligence Gathering- In this stage, information about the target system are gathered from all publicly accessible data sources like social media websites, official records, etc. This procedure is also called OSINT (Open Source Intelligence). It is all about gathering any piece of information that might be helpful at a later stage of the testing procedure.

  • Threat Modelling- Here, the penetration tester try to identify assets that can be most likely targeted as well as the resources (human or non-human) that can be employed to target those assets. It helps in defining counter-measures to prevent or mitigate the system threats. it can be skipped in typical pan tests.

  • Vulnerability Analysis- This stage discovers and validates vulnerabilities. This risk can allow an attacker to exploit and gain authorized access to the system or application.

  • Exploitation- This stage is the most important part of a penetration test. The tester will try to reach the security of a target system with the help of previously identified and validated vulnerabilities. The tester will get the most out of the attack's results and insights by adhering to the rules of stealth, speed, and depth of penetration testing. 

  • Post Exploitation- This one maintains the control over target system and collect data. The findings in the post exploitation stage may result in change of scope and other possible problems if exploitations reveal deeper and more complicated flaws that the client did not foresee.

  • Reporting- Finally, a report will be compiled with all the information from every stage. It will contain all the documentations of the operations happened from planning and attacking to post exploitation, key findings of the security, and risk as well as correction. The report indicates the end of the penetration test

Conclusion

This part talks about PTES, its definition, and seven stages of its process in detail.






































Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different groups of computers, re
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning of alert rule parameter
Read more

Design Planning (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Complex Organizational Structures SIEM can be an expensive security control, hence, it is common multiple businesses to contribute to the overall expense. Various organizational units may require a level of access to specific dashboards or sets of data. Microsoft Sentinel offers the ability to assign table-level permissions and limit the level of access to the minimum required to perform requisite job functions.  Role-based Access Control (RBAC) Requirements Microsoft Sentinel offers an extensive list of Azure built-in roles that can be used to provide granular access according to the job requirements and permitted level of access. Some of them are various Microsoft Sentinel dedicated roles: Microsoft Sentinel Contributor- Can perform all engineering-related configuration, such as creating alert rules, configuring data connectors, and additional similar tasks.  Microsoft Sentinel Reader- Can query the log data stor
Read more