How do you match your penetration testing to industry standards?

1 Why follow industry standards?

Penetration testing is a highly context-specific process, requiring different methodologies, techniques, and tools depending on the scope and objectives. To guarantee ethical, legal, and reliable testing, you should adhere to industry standards that define the minimum requirements, guidelines, and principles for conducting penetration testing. This will enable you to create a common language and terminology for penetration testing, align your testing with client or stakeholder expectations, demonstrate your professionalism and competence as a penetration tester, avoid potential legal or ethical issues, and benchmark your testing against best practices and peer reviews.

2 What are some industry standards?

Penetration testing is a process that requires guidance from industry standards and frameworks. Some of the most widely recognized and adopted ones include the Penetration Testing Execution Standard (PTES), the Open Source Security Testing Methodology Manual (OSSTMM), the NIST Special Publication 800-115, and the ISO/IEC 27001. PTES is comprehensive and covers the entire process from pre-engagement to reporting, while OSSTMM focuses on operational security of systems, networks, and applications. NIST Special Publication 800-115 provides recommendations and procedures for planning, conducting, and reporting penetration testing. ISO/IEC 27001 is an international standard that specifies requirements for establishing, implementing, maintaining, and improving an information security management system (ISMS). It also includes a section on information security testing.

3 How to choose the right standard?

When selecting the right standard for penetration testing, there is no one-size-fits-all solution. You need to consider several factors, such as the type and complexity of the target, industry and regulatory requirements, client and stakeholder expectations, and resources and constraints. For instance, PTES may be more suitable for web application testing while OSSTMM may be more suitable for network testing. Depending on the industry or sector, you may need to follow certain standards like PCI DSS or HIPAA. Additionally, some clients may prefer a formal report while others may prefer a concise one. Moreover, different standards may require different resources and time implications. Therefore, it is important to balance the quality and scope of your testing with the available budget, time, and personnel.

4 How to use penetration testing tools?

Penetration testing tools are essential for conducting effective and efficient penetration testing, as they can help you automate, simplify, or enhance various aspects of your testing. For instance, tools such as Nmap, Shodan, Metasploit, Nessus, Burp Suite, ZAP, Nikto, SQLmap, Hydra, Netcat, Mimikatz, PowerShell, Meterpreter, Dradis, Serpico and Pentest-Report can be used to carry out reconnaissance on a target to find its IP address and domain name; scan for vulnerabilities or misconfigurations; exploit the identified weaknesses; perform post-exploitation activities such as escalating privileges and data exfiltration; and document and present findings to a client or stakeholder.

5 How to match your tools to the standard?

When using penetration testing tools, it is important to use them wisely and responsibly, and to match them to the standard you are following. To do this, you should choose tools that are compatible and compliant with the standard, configure them according to the standard, validate and verify the results of the tools according to the standard, and document and report the use of the tools according to the standard. For example, some standards may require you to adjust settings or options of the tools, cross-check or confirm results with other sources or methods, or record and cite their output in your report.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?