Penetration Testing and Ethical Hacking

[EdSkinner1]

Good Morning,

We are reviewing our organization's information security posture, and we have a few questions that we would like to pose to the group:

1) What activities does your organization engage in for the areas of penetration testing and/or ethical hacking?

2) Which of these activities do you consider valuable (and would recommend), and what key risks are associated with implementing them?

3) Are there other activities in these areas that you hope to implement in the future?

We appreciate any feedback (if your feedback is too sensitive for posting, we'd be happy to email or setup a call, etc.).

Thanks!

-Ed

[Caute_cautim]

@EdSkinner1    Try this consolidated link via OWASP and OSSTMM, NIST-800-115 etc:

https://owasp.org/www-project-web-security-testing-guide/latest/3-The_OWASP_Testing_Framework/1-Pene...

This should give you a good grounding and a baseline to determine what you want from Ethical Penetration Testing services and for contractual purposes and measurement.

Regards

Caute_Cautim

[CraginS]

@EdSkinner1 

My former employer did a lot of research on and use of phishing attacks. My core advice on using phishing attacks as part of your EH set is to make sure it is set up as a training experience for the employees, and not a gotcha jump on them.

Also, make darn sure you pay special attention to targeting your whales. 

Good luck,

Craig

[EdSkinner1]

Thanks!

[EdSkinner1]

Thanks!

[Kaisar_Ahmed]

Good Morning Ed,

Thanks for reaching out! Here are my responses to the questions from a beginner’s perspective:

1) In our organization, we do some basic penetration testing, like checking if our systems are secure from outside threats. We also test our web applications to see if there are any vulnerabilities that could be exploited. We’re just starting to explore ethical hacking practices to see where we can improve our security.

2) I think these activities are really helpful because they allow us to spot weaknesses before anyone else does. One risk is that if the testing isn’t planned well, it could affect our systems. Also, handling the sensitive results of these tests requires caution to ensure they don’t fall into the wrong hands.

3) Looking forward, we’d like to add more automated tools to regularly check our systems and keep our defenses up-to-date as new threats come up.

Let me know if I can provide more information.

Best regards,
Kaisar Ahmed