In this lesson,
we'll cover the Penetration Testing Execution Standard,
or PTES.
This is a framework used to conduct
a thorough and effective penetration test.
Unlike ad-hoc methods, PTES offers a structured approach
to testing the security of information systems and network.
We'll go over the high-level organization of PTES
and its seven main sections which guide testers
from planning to detailed reporting.
First, we have the Pre-engagement interactions.
This initial phase involves the first communication
and the reason for conducting a penetration test.
This section outlines essential tools
and techniques for a successful start.
Customers should refer to the general question section
before the test begins to clarify any details
and ensure that the process is smooth
and focus on identifying business risk.
This space includes metrics for time estimation,
scoping meetings, additional support, questionnaires,
general questions, scope creep,
start and end dates,
IP ranges and domains, dealing with third parties,
acceptable social engineering pretexts, DoS testing,
payment terms, goals, lines of communication,
emergency contact information,
rules of engagement and technology in place.
So we see there's a lot there,
but this guide gives us everything we need
for the pre-engagement interactions.
Next is the Information Gathering phase.
This phase is essential for laying the groundwork
for an effective penetration test.
It's structured to progressively deepen the intelligence
gathered about the target, divided into three levels:
Compliance Driven, Best Practice, and State Sponsored.
Open-Source Intelligence is also part of this phase,
providing insights into the target's
physical and digital footprint.
This includes corporate structure and technology setups.
Footprinting which involves passive
and active techniques maps out the target's
external and internal network environment,
identifying potential vulnerabilities and security gaps.
The third phase is Threat Modeling.
Threat modeling involves understanding
both the business assets and processes that need protection
and the threats and their capabilities.
It helps prioritize which assets are most critical
and which threat vectors to focus on.
This phase should be a collaborative effort
with the organization being tested,
or it should be built upon open-source intelligence
discovered during a black-box scenario.
The final threat model is documented in detail
in a penetration test report,
linking findings to specific threats
and providing a tailored risk assessment.
This helps strengthen the organization's defenses
against the most plausible threats.
The fourth phase is Vulnerability Analysis.
This phase involves using both active
and passive testing techniques
to identify security weaknesses
in the organization's IT infrastructure.
Active testing involves directly interacting with the system
to probe for vulnerabilities, like outdated software,
or configuration errors.
Passive testing involves observing the system
without direct interaction to gather information
that could indicate potential vulnerabilities.
Once vulnerabilities are identified,
validation steps confirm their existence and exploitability,
ensuring that they're not just false positives.
And fifth, we have the Exploitation phase.
This phase involves actively exploiting
the identified vulnerabilities.
It seems like an attacker's attempt
to exploit weaknesses to gain access
or elevate privileges within the target system.
Exploitation demonstrates the potential real-world impact
of vulnerabilities on the organizations.
Techniques used may include injecting code,
manipulating protocols, or hijacking sessions
to assess how much the system can be compromised.
Sixth, we have the Post-exploitation phase.
This follows a successful exploitation
where the tester has gained some level of access.
Now, this phase explores
what an attacker could achieve further within the system.
Activities during this phase include
accessing sensitive data, escalating privileges,
installing back doors for persistence,
and navigating the network
to reach critical systems or data.
Now, this stage helps understand the potential damage
and impact of a breach, assessing the effectiveness
of internal defenses and response strategies.
Now, the final phase of the PTES is, of course, Reporting.
This involves compiling a detailed report
of all activities conducted during a test,
the vulnerabilities exploited, and systems accessed,
and the potential impact on the organization.
The report provides a thorough analysis
of security weaknesses uncovered,
along with clear, actionable recommendations
for remediation.
The goal is to guide the organization into strengthening
its defenses and improving its overall security framework
to withstand future attacks.
The report should be understandable to both technical
and non-technical stakeholders since, ultimately,
a lot of times, the people making decisions
are non-technical stakeholders.
So remember,
the Penetration Testing Execution Standard (PTES)
offers a structured framework
for conducted penetration tests.
By following the seven key phases of the PTES,
which are pre-engagement interactions,
information gathering, threat modeling,
vulnerability analysis, exploitation,
post-exploitation, and reporting,
testers can perform thorough, effective,
and value-driven penetration tests that, again,
not only highlight the current vulnerabilities,
but also provide actionable recommendations
for improving the security posture of the organization.