Access Control and Identity Management, 3rd Edition



Performing the Access Control System Penetration Test

A penetration test is any simulated attack scenario. It could be purely technological, it could focus on uncovering weaknesses to social engineering tactics, or it could take a holistic approach and use any and all tactics and tools available to penetrate the organization’s defenses. Because this type of testing is inherently invasive and simulates as close as possible the methods of an actual attack, it is important that all parties have a clear outline of what will be done, what restrictions (if any) must be followed, and what the tests are designed to uncover. If there is any miscommunication between the testers and the organization’s management ...