Penetration testing
In penetration testing, the tester uses the same techniques as used by hackers to gain access to critical systems/data. This helps the auditor to determine the security environment of the organization. Penetration testing helps to identify the risk relevant to the confidentiality, integrity, and availability of information systems. The objective of penetration testing is to verify the control environment of the organization and to take corrective action if a deficiency is noted. Penetration testing needs to be conducted only by a qualified and experienced professional.
Aspects to be covered within the scope of the test
From a risk perspective, the following aspects need to be covered within the scope of penetration testing:
- Precise details of IP addresses need to be included in the scope of the audit. Details of the testing technique (SQL injection/DoS/DDoS/social engineering, and so on) should be provided.
- The day and time of the attack (that...
