A study on penetration testing methodology

초록

In recent years, information technology has been progressing rapidly. Yet as the technology has progressed, the threats and risks have also evolved quickly. In order to respond to this problem, enterprises and institutes are conducting Penetration Tests (Pen-Test) as one of the methods to strengthen security. Penetration tests have been performed under the same terms as simulated penetration tests after legal approval, or simulated hacking tests. In this test, the weak points of an invaded system are found, and then based on the test results the security of the system is actively evaluated and further strengthened. When the reliability and the test strength are not properly evaluated in the penetration test, it is difficult to receive a proper evaluation of the performance results for security improvement and thus it is not possible to say that the test has been conducted properly. With this in mind, the objective of this research is to propose the criteria for selecting the methodology of a penetration test, by investigating and comparing existing penetration test methodologies. © 2015 Yong-Suk Kang, Hee-Hoon Cho, Yongtae Shin and Jong-Bae Kim.

키워드