The Network Security. Org

RSS Feed

← Protect Your Windows Systems How to thwart attackers who try to gain knowledge of your application through its error handling messages →

Penetration Testing: A Systematic Approach

September 1st, 2006 · No Comments


The question most commonly asked by any organization is “Why would I ever need a penetration dataprotection2.jpgtest?” after all it costs a lot of money in hiring an external consulting firm or to invest in expensive tools to perform a penetration test. You must realize that it is very important for any organization to justify the cost involved for such an activity.

The important thing here that needs to be understood is that you may be successful in finding loads of vulnerabilities in any system, but unless those results are not analyzed thoroughly and a proper risk mitigation plan is not prepared, the test would not add any significant value to the business of any organization. Thus for giving a complete value for money, a successful penetration test would be that which would help an organization to understand the business risks arising from the vulnerabilities, and would provide a proper risk mitigation plan that fits the organizations business policy.

Agreed that a penetration test would involve a lot of risks like bringing a production system down, etc., but a properly planned penetration test would definitely add value in an organizations security framework. It should be understood that a penetration test with proper systematic approach, if included as an ongoing process in an organizations risk assessment plan, will lead to a better understanding of the current security posture of the organization and will help the organization in mitigating the risks at the proper time. Infosecwriters.com

From around the Web

  • Advertisments