1. Chris Romano Andrew Shepardson IA 456
Penetration Tests
Chris Romano
Andrew Shepardson
IA 456

2. Pen-Test?

3. Vulnerability Assessment == Find
Differences
Vulnerability Assessment == Find 
Penetration Test == Exploit 

4. Pen-Test?
Evaluating a system’s security infrastructure by trying to exploit vulnerabilities
A set goal to be reached
 Started by the DoD in mid-1960’s
One component of a full security audit

5. Do I need a Pen-Test? Find entry points before an attacker does
Test development environments
Compliance

6. What’s Vulnerable?

7. Everything

8. The Steps Obtain information Conduct Identify & Confirm Address
Exposures

9. Types of Pen Tests External: outside attacker
Internal: inside attacker
Blind: tester only given name of organization
Double Blind: 1-2 individuals aware of testing
Targeted: tester + security team work together

10. Should I be assessed?
Avoid Breaches
Compliance
Improve policies

11. Testing Tools

12. Scanning Tools

13. Basic Pen Testing Example

14. How to get involved