Topic 1b: PM, Methodologies & Frameworks

Topic 1b: PM, Methodologies & Frameworks

1. Security Testing Requirements

   • Repeatable, documented assessment methodology
     • Why?
       • Provide
         • Consistency/Structure
         • Goals
       • Assigns R&R
       • Maximise Values
       • Minimize Risks

2. METHODOLOGIES

   • OSSTMM
     • Open Source Security Testing Methodology Manual
     • Draft v4 (2010)
     • Components
       • Rules of Engagement
         • Similar to ISSAF Planning & Prep Phase
       • Channels
         • COMMSEC
         • PHYSEC
         • SPECSEC
     • 17 Modules
       • 1-3
         • Regulatory Phase
       • 4-7
         • Definition Phase
       • 8-13
         • Info Phase
       • 14-17
         • Interactive Controls Test Phase
   • ISSAF
     • Information Systems Security Assessment Framework
     • Draft v0.21b (2006)
     • Phases
       • Planning & Prep
       • Assessment [EXTENSIVE]
         • 9 Operational Steps (Pen Test Methodology)
           • 1) Info Gathering
           • 2) N/W Mapping
           • 3) Vuln Identification
           • 4) Penetration
           • 5) Gaining Access & Priv Escalation
           • 6) Enumerating Further
           • 7) Compromising Remote Users/Sites
           • 8) Maintaining Access
           • 9) Covering Tracks
       • Reporting, clean-up & destruction of artifacts
     • Properties
       • Less flexible than OSSTMM
       • Not been maintained
       • Easier to understand than OSSTMM