How to Cheat at Managing Information Security

Chapter 12

Network Penetration Testing

The purpose of this chapter is to:

■ Provide a working definition of penetration testing (pen testing) and show how it differs from a hacker attack

■ Outline a methodology and overview of the techniques for doing pen tests

■ Describe the paperwork you need to protect yourself

Anecdote

In 1996, when pen testing was very new to the commercial world and covert pen testing was unheard of, I was part of a team that was doing a covert test on a major securities business in Luxembourg.

It was one of the best jobs of my life. Knee-tremblingly exciting work, three weeks in a five-star-plus hotel, flying back home every Friday afternoon on business class flights with free champagne—a real consultant’s dream.

But the client ...