All language subtitles for 006 PenTest Standards (OBJ 1.2)

Instructor: There are numerous resources, standards,

and guidelines that are available for you to use

when planning your penetration tests.

This includes the Open Web Application Security Project,

known as OWASP;

the Open Source Security Testing Methodology Manual,

known as OSSTMM;

the Information System Security Assessment Framework,

known as ISSAF;

and the Penetration Testing Execution Standard,

known as PTES.

First, we have the Open Web Application Security Project,

known as OWASP.

The Open Web Application Security Project

is a nonprofit foundation

that works to improve the security of software.

The foundation provides community-led software projects,

education and training, and it's also become the source

for developers and professionals who want to secure the web.

OWASP has created the framework for testing

during each phase of the software development process

as a way to increase the awareness of web security

across the industry.

One way they do this is

by providing the OWASP web security testing guide.

This testing guide is a comprehensive guide

to testing the security of web applications and web services

that is created by the collaborative efforts

of cyber security professionals and dedicated volunteers.

This guide provides a framework of best practices

that are used by penetration testers

and organizations all over the world,

and it can be found for free at OWASP.org.

But probably the top thing that OWASP is known for

is its Top 10 list.

The OWASP Top 10 is a standard awareness document

for developers and web application security experts.

It represents a broad consensus

about the most critical security risks to web applications

and provides information on how to prevent them.

For example, the Top 10 for 2021 has broken access control,

cryptographic failures, injections,

insecure design, security misconfigurations,

vulnerable and outdated components,

identification and authentication failures,

software and data integrity failures,

security logging and monitoring failures,

and server-side request forgery as its Top 10.

Now, for each of these,

you can read a description of the vulnerability,

how to prevent it,

example attack scenarios complete with code,

links to relevant common weakness enumeration or CWE numbers

and a list of references

for how to test for those during an engagement.

Second, we have the Open-Source Security Testing

Methodology Manual, known as the OSSTMM.

The Open-Source Security Testing Methodology Manual

provides a methodology for a thorough security test

which they refer to as an OSSTMM audit.

This audit is used to create an accurate measurement

of security at an operational level

inside of an organization.

This is one that is void of any assumptions

or anecdotal evidence as well.

This methodology is designed to be consistent

and repeatable using the same principles

that a scientific experiment might.

The project is open-source,

so it allows for any penetration tester

to contribute ideas for performing more accurate, actionable

and efficient security tests.

It's also free to disseminate and use

because it's not the intellectual property

of any single corporation or government.

The manual aims to be a straightforward tool

for the implementation and documentation

of penetration or security tests.

The real focus in the OSSTMM is auditing, validation,

and verification by using facts

and not anyone's opinion during the engagement.

Also, with that being said, the latest version

of the OSSTMM as of right now is version three,

which was released all the way back in 2010.

So, keep that in mind

because it can be a little bit outdated.

Third, we have the Information System Security

Assessment Framework known as the ISSAF.

This methodology was created

by the Open Information System Security Group,

known as OISSG.

The ISSAF is a bit out of date as well

but it can still be a useful reference.

Now, one of the benefits

of the Information System Security Assessment Framework

is how it links individual penetration testing steps

with the relevant penetration testing tools.

The goal of this framework was

to provide a comprehensive guide

when conducting a penetration test.

But like I said, it is a bit outdated

because it was last updated in 2015,

and many of its supporting documents haven't been updated

since 2005.

To download the ISSAF documentation,

you can simply go to Google and enter the term "ISSAF"

and you're gonna find their source forge repository

with all the files compressed

as an archive for easy downloading.

Included in that is about 35 to 40 files

and each one is focused on a different area

of penetration testing, such as routers,

storage area networks, SQL injections, physical security,

and many more.

It can be a good starting point or reference

if you want to build your methodology as well,

but overall, it is outdated.

And so only bringing up

because it is listed on your exam objectives.

Fourth,

we have the Penetration Testing Execution Standard,

known as PTES.

Now, the Penetration Testing Execution Standard

was developed to cover everything related

to a penetration test from the initial communication

and the reasoning behind that test

all the way through intelligence gathering

and threat modeling phases

where the testers are working behind the scenes

in order to get a better understanding

of the tested organization,

and then into the vulnerability research,

exploitation and post exploitation phases

where the technical security expertise of the testers comes

to play and combines with the business understanding

of that engagement,

and finally into the reporting phase

which captures the entire process in a manner

that makes sense to the customer

and provides them the most value from it.

Now, the Penetration Testing Execution Standard

was designed around seven main sections:

pre-engagement interactions,

intelligence gathering,

threat modeling,

vulnerability analysis,

exploitation,

post exploitation,

and reporting.

The goal of the Penetration Testing Execution Standard

was to create a new standard

that provided both businesses and security service providers

with a common language and scope

when you're performing a penetration test.

Now, the Penetration Testing Execution Standard

was first drafted all the way back in 2009.

And honestly,

it appears to be another good idea project

that has since been abandoned,

or at least relegated to the we'll-work-on-it-someday pile

by its founders.

Like ISSAF and OSSTMM,

I'm really covering it here for the sake of completeness

because it is listed by name in the exam objectives

by CompTIA.

Now, when it comes to high quality, well-maintained,

and up to date resources,

I personally like to stick with OWASP

or the Open Web Application Security Project

because they're constantly updating their materials

and their website.

Now, that being said, remember OWASP specializes

in web application security,

so it is not useful if you're looking

at traditional infrastructure or endpoints

during your penetration test.

For those, you're gonna have to rely

on something like OSSTMM, ISSAF, or PTES.