In this section of the course,
we're going to take a close look at pen test frameworks.
Pen-test frameworks are basically the guidebooks
or set of rules to help define
how to conduct penetration tests from start to finish.
Penetration testing frameworks provide a structured approach
to identify security weaknesses
in computer systems, networks, or applications,
ensuring tests are thorough and cover all important areas.
They also help testers follow legal
and technical guidelines,
which reduces risk to the penetration tester.
This section will be centered around
Domain 1: Engagement Management.
Our focus will be Objective 1.3,
which asks us to compare
and contrast testing frameworks and methodologies.
This means we're going to look at how different framework
and methods stack up against each other,
what makes each of them unique,
and how they can be used in various testing scenarios.
First, we have the MITRE ATT&CK.
This is like a playbook of different ways
attackers can threaten your networks and system.
It's really useful for understanding potential threats
and planning how to defend against them.
Second, OWASP.
This stands for the Open Web Application Security Project.
It's all about making sure web applications are secure
and safe from hacking attempts.
Think of it as a best practice guide for web security.
Third, we have M-A-S-V-S, which stands
for the Mobile Application Security Verification Standard.
It's like OWASP but for mobile apps.
It helps testers understand what to look for
when making sure mobile apps are secure.
Fourth, we have P-T-E-S.
The Penetration Testing Execution Standard
outlines a complete penetration testing process.
It covers everything from gathering info from the start
to reporting the findings afterward.
Fifth, there's CREST, which stands
for the Council of Registered Ethical Security Testers.
This is a certification and accreditation body
that sets high standards for penetration testing.
It's like a stamp of approval for testers
that meet their strict criteria.
Sixth there is O-S-S-T-M-M.
The Open-Source Security Testing Methodology Manual
offers a overview
and a way to test the security of systems and networks.
It's very thorough and covers a lot of ground.
Seventh, we have STRIDE.
This framework is used
to identify computer security threats.
It stands for Spoofing, Tampering, Repudiation,
Information disclosure, Denial of service,
and Elevation of Privileges.
Coming in at number eight, we have the Purdue Model.
This model is all about industrial control system
and how to organize your network security.
It's really good for understanding how to protect systems
that control physical equipment.
Ninth, there's OCTAVE.
This stands for Operationally Critical Threat,
Asset, and Vulnerability Evaluation.
It's a framework for identifying
and managing risk in organizations and businesses.
And last but not least, we have DREAD,
and it's not as bad as the name sounds.
This a simple way to assess the risk of security threats.
It stands for Damage, Reproducibility,
Exploitability, Affected users and Discoverability.
As you can see, we have a lot of different frameworks
to cover throughout this section,
but we'll make sure to give you everything you need to know
about each framework and methodology.
We'll be highlighting what each one is best used for
and how they can be applied
to the real-world penetration testing scenarios.
We'll also discuss the pros and cons of each,
helping you understand when
and why you might choose one over the other.
Finally, we'll take a short quiz
to see what you learn from this section of the course
and review each of those quiz questions
to fully ensure you can explain why each answer was right.
If you're ready, let's begin our section
on pen test frameworks.