Penetration testing

Skill definition

Penetration testing is a method for gaining assurance in the security of an IT system by attempting to breach some or all of that system’s security, using the tools and techniques that an adversary might employ. Principles of the skill include contributing to the scoping and conduct of vulnerability assessments; knowing the tools and techniques needed to enumerate an environment and assess asset configuration; identifying and testing for public domain vulnerabilities, assessing the potential for exploitation, and conducting exploits where appropriate; reporting potential issues and mitigation options; contributing to the review and interpretation of reports; and co- coordinating and managing remediation action plan responses. This skill has broad applicability across many roles.

Awareness

Understands and can explain the difference between vulnerability assessment and penetration testing and their purpose, and recognises the value of testing in supporting information security and configuration compliance
Understands the basic principles, processes and components of penetration testing and can describe how these are applied in practice. Appreciates the risks of testing and the governance associated in executing such tests
Understands the difference between red, blue and purple team simulated attack exercises and can explain the objectives and goals for each Has studied penetration exercises that illustrate scenarios based on threat intelligence and is able to list common types of vulnerabilities for infrastructure and web application targets
Has training in penetration testing and has experience of using a limited number of testing tools ‘out of the box’ with basic functionality
May have successfully completed simulated exercises in penetration testing within a training or academic environment or participated in syndicated exercises, undertaking practical exercises, or passing a test or examination (although there are no mandatory qualifications)

Working

Explains the principles of penetration testing, the main components of an infrastructure penetration test and the high-level processes involved, to practitioners and non-practitioners alike
Provides pragmatic input to assist in the development of penetration testing policies, procedures and guidelines and understands their business context
Helps ensure compliance of working practices by educating colleagues in basic penetration testing policies, procedures and guidelines
Performs basic tests or attack exercises by following documented principles and guidelines for penetration testing activities and interprets results, with little or no supervision
Uses preconfigured commercial and bespoke tools to conduct vulnerability assessments and basic penetration tests without supervision and complex infrastructure penetration testing under supervision
Understands the potential risks of security testing in different operational environments and takes them into account while developing plans
Makes contributions to assessment reports that are factual and literal, rather than interpretive
Has solid rather than wide platform knowledge being strong on a single platform (e.g. Windows, Mac)
Has achieved recognised qualifications in appropriate and relevant subjects, including Offensive Security Certified Professional, CHECK Team Member or equivalent

Practitioner

Leads teams undertaking complex penetration tests
Follows documented principles and guidelines for high-complexity penetration testing activities
Designs and implements test programmes for mid-complexity systems, products, applications or processes, selecting suitable techniques, tools and test strategies without supervision
Identifies vulnerabilities, and determines whether they are exploitable, adapting testing approach based on findings
Detects and investigates result aberrations, or absences of expected results
Creates assessment reports, confirming technology compliance with standards and policies and vulnerabilities, and provides suggested remediation actions
Advises others on penetration testing processes, the implications of testing, and sharing penetration testing best practice
Has a broader platform knowledge and conducts assessments from a multi-platform perspective
Has achieved recognised qualifications in appropriate and relevant subjects, to a high-functioning level, including CHECK Team Leader, CREST Certified Simulated Attack Specialist or equivalent

Expert

Takes a multi-customer approach to establishing penetration testing policies, procedures and guidelines, taking into account organisational and national level perspectives
Has responsibility for penetration testing services and drives organisational and business change to better comply with policies, procedures and guidelines
Ensures effective delivery of penetration testing assessments for organisational benefit
Leads organisational teams in various stages of test design, execution, and assessment, for multiple customers, potentially across multiple organisations, and that comply with policies, procedures and guidelines
Improves organisational penetration testing processes, achieving high standards of excellence
Champions the organisational recognition of value of penetration testing services, and the benefits of addressing the results
Authoritatively influences the organisational management regarding penetration testing concepts and activities
Builds on, and advances, practitioner level skills for self and colleagues
Communicates complex issues at the appropriate level for the audience
Has achieved appropriate level of qualifications, including CREST Certified Simulated Attack Manager or equivalent