In this lesson,
we'll explore the CREST Defensible Penetration Test
Guidelines, also known as the CDPT Guidelines.
These guidelines establish a standard
for conducting penetration tests
with a clear, structured approach.
Now we'll dive into these guidelines to see
how they ensure penetration tests are effective
and deliver high-quality results.
The guidelines really focus on the importance
of tests being scoped, delivered,
and evaluated by skilled professionals.
First, let's talk about what CREST is.
CREST stands for the Council
of Registered Ethical Security Testers.
It's an organization of security companies
that sets rigorous standards for cybersecurity services.
CREST accreditation system is thorough,
aimed at evaluating the quality
of service delivered by its members.
With over 300 members worldwide,
including many leading security companies,
CREST ensures these companies meet high standards
of quality and integrity.
To become CREST certified,
a company goes through an extensive
audit and accreditation process.
This ensures they meet CREST's stringent standards.
CREST-accredited companies follow strict Codes
of Conduct and Ethics and commit to robust Complaints
and Resolution Measures.
Governments, public services, and businesses
using services from CREST-accredited companies
can trust that they will receive professional
and high qualified services.
Now that we know who and what CREST is,
let's discuss their Defensible Penetration Test Guidelines.
The CDPT guideline document is organized into 10 sections
plus an additional section for definitions.
Each section contributes to the nature
of a defensible penetration test.
The first section, the Executive Summary,
clarifies common terms
and sets the stage for the unified understanding
of a penetration test across the industry.
Next is the Background section,
which discusses the evolution
and variability of penetration testing practices.
It emphasizes the importance of having a global standard
to ensure consistency and quality.
The Commercially Defensible Assurance Activity section
emphasizes the legal
and commercial defensibility of penetration tests.
It requires tests to be conducted by competent individuals
to ensure their credibility and reliability.
The guideline also stresses the correct use
of the document in the
How This Specification Should be Used section.
This ensures that penetration testing practices
are compliant and effective.
The Quality Assurance of Organizations section
discusses the need for reliable
and certified penetration testing providers.
Then we have the Benefits
of the CREST Accreditation section,
which outlines the advantages
of choosing CREST accredited companies.
These companies are rigorously vetted,
which enhances their trust and reliability of the service.
Then we have a section on Suitably Skilled
and Competent Individuals, highlighting the qualifications
and ethical standards required
of professionals conducting these tests.
The "Importance of Defining Goals & Objectives" section
in the CREST guideline
emphasizes the necessity of having clear goals
and objectives for penetration testing.
When organizations procure penetration testing services,
they do so to meet specific needs or requirements.
Now, these goals should be clearly defined to the buyer
during the procurement process
and listed by service providers
in all scoping documents and reports.
And then we have the " A Question of Scope" section,
which highlights the importance
of properly defining the scope of a penetration test.
Properly scoping helps in identifying the relevant attack
services like network or local area network, et cetera,
and it just assures that we're focused on the attack vectors
that are most relevant to the customer.
Finally, the Reporting Framework section
details the expectations for a comprehensive
report on the testing findings.
This ensures that the reports are valuable
and informative for the clients.
So remember, the CDPT guidelines are designed
to standardize penetration testing processes.
They ensure that tests are thorough, defensible,
and conducted by qualified professionals.
Now, these standards not only safeguard the integrity
of the testing process,
but also ensure that the findings are actionable
and beneficial for enhancing
the client's cybersecurity posture.
The key takeaway is that CREST is designed
to find highly qualified individuals
and companies for penetration tests.