Penetration testing

Skill Definition

Penetration testing is a method for gaining assurance in the security of an IT system by attempting to breach some or all of that system’s security, using the tools and techniques that an adversary might employ. Principles of the skill include contributing to the scoping and conduct of vulnerability assessments; knowing the tools and techniques needed to enumerate an environment and assess asset configuration; identifying and testing for public domain vulnerabilities, assessing the potential for exploitation, and conducting exploits where appropriate; reporting potential issues and mitigation options; contributing to the review and interpretation of reports; and co- coordinating and managing remediation action plan responses. This skill has broad applicability across many roles.

Awareness

Understands and can explain the difference between vulnerability assessment and penetration testing and their purpose, and recognises the value of testing in supporting information security and configuration compliance

Understands the basic principles, processes and components of penetration testing and can describe how these are applied in practice. Appreciates the risks of testing and the governance associated in executing such tests

Understands the difference between red, blue and purple team simulated attack exercises and can explain the objectives and goals for each Has studied penetration exercises that illustrate scenarios based on threat intelligence and is able to list common types of vulnerabilities for infrastructure and web application targets

Has training in penetration testing and has experience of using a limited number of testing tools ‘out of the box’ with basic functionality

May have successfully completed simulated exercises in penetration testing within a training or academic environment or participated in syndicated exercises, undertaking practical exercises, or passing a test or examination (although there are no mandatory qualifications)

Working

Explains the principles of penetration testing, the main components of an infrastructure penetration test and the high-level processes involved, to practitioners and non-practitioners alike

Provides pragmatic input to assist in the development of penetration testing policies, procedures and guidelines and understands their business context

Helps ensure compliance of working practices by educating colleagues in basic penetration testing policies, procedures and guidelines

Performs basic tests or attack exercises by following documented principles and guidelines for penetration testing activities and interprets results, with little or no supervision

Uses preconfigured commercial and bespoke tools to conduct vulnerability assessments and basic penetration tests without supervision and complex infrastructure penetration testing under supervision

Understands the potential risks of security testing in different operational environments and takes them into account while developing plans

Makes contributions to assessment reports that are factual and literal, rather than interpretive

Has solid rather than wide platform knowledge being strong on a single platform (e.g. Windows, Mac)

Has achieved recognised qualifications in appropriate and relevant subjects, including Offensive Security Certified Professional, CHECK Team Member or equivalent

Practitioner

Leads teams undertaking complex penetration tests

Follows documented principles and guidelines for high-complexity penetration testing activities

Designs and implements test programmes for mid-complexity systems, products, applications or processes, selecting suitable techniques, tools and test strategies without supervision

Identifies vulnerabilities, and determines whether they are exploitable, adapting testing approach based on findings

Detects and investigates result aberrations, or absences of expected results

Creates assessment reports, confirming technology compliance with standards and policies and vulnerabilities, and provides suggested remediation actions

Advises others on penetration testing processes, the implications of testing, and sharing penetration testing best practice

Has a broader platform knowledge and conducts assessments from a multi-platform perspective

Has achieved recognised qualifications in appropriate and relevant subjects, to a high-functioning level, including CHECK Team Leader, CREST Certified Simulated Attack Specialist or equivalent

Expert

Takes a multi-customer approach to establishing penetration testing policies, procedures and guidelines, taking into account organisational and national level perspectives

Has responsibility for penetration testing services and drives organisational and business change to better comply with policies, procedures and guidelines

Ensures effective delivery of penetration testing assessments for organisational benefit

Leads organisational teams in various stages of test design, execution, and assessment, for multiple customers, potentially across multiple organisations, and that comply with policies, procedures and guidelines

Improves organisational penetration testing processes, achieving high standards of excellence

Champions the organisational recognition of value of penetration testing services, and the benefits of addressing the results

Authoritatively influences the organisational management regarding penetration testing concepts and activities

Builds on, and advances, practitioner level skills for self and colleagues

Communicates complex issues at the appropriate level for the audience

Has achieved appropriate level of qualifications, including CREST Certified Simulated Attack Manager or equivalent