|
P packet Flooding Attack Network Bandwidth Denial of Service (DoS) Packet-Dropping AttackBog'liq gu2011 AQLLI SHAHAR, TEST, 1-мактаб тўгарак жадвал, BUYRUQ. YASIN BREND, TAQRIZ YANGI, 2, Tarjima SPLINES, DIFFERENTIAL EQUATIONS, AND OPTIMAL, (11-ozbetinshe K.U.A)Q.Zafar, APPLIKATSIYADA QIRQISHNI HAR HIL USULLARINI BAJARISH, EDUCATION SYSTEM OF UZBEKISTON, O’zbekistonning va jahon hamjamiyati, OCHILOVA NIGORANING, 7 yosh inqirozi uning sabablari va alomatlari, TEXNIKA MADANIYATI, AAARecommended Reading
. Privacy-Enhanced Electronic Mail (PEM) Charter.
http://www.
ietf.org/proceedings/mar/charters/pem- charter.html
. RfC: privacy enhancement for internet electronic mail: part I:
message encryption and authentication procedures.
http://www.
rfc-editor.org/rfc.html
. RfC: privacy enhancement for internet electronic mail: part
II: certificate-based key management (RFC ).
http://www.
rfc-editor.org/rfc.html
. RfC: privacy enhancement for internet electronic mail: part
III: algorithms, modes, and identifiers (RFC ).
http://www.
rfc-editor.org/rfc.html
. RfC: privacy enhancement for internet electronic mail: part
IV: key certification and related services (RFC ).
http://www.
rfc-editor.org/rfc.html
Penetration Testing
Tom Caddy
InfoGard Laboratories, San Luis Obispo, CA, USA
Related Concepts
Common Criteria
Definition
Penetration testing is part of a security assessment (e.g.,
Audit) or certification process (e.g.,
Common Criteria
)
with an objective to locate and eliminate security vulnera-
bilities that could be exploited to gain access to the security
target (system, device or module) by a potential attacker.
Theory
In a penetration test, the objective of an attacker is to
gain access to the security target by breaking or circum-
venting its security measures. In other words, an attacker
needs only to find one vulnerability to successfully pen-
etrate the security target, while the penetrations testers’
objective task is to identify all vulnerabilities. Penetration
test constraints as well as constraints for an attacker are
time, money, amount of effort, and resources. Given these
constraints (e.g., resources and time), exploiting a vulner-
ability and successfully penetrating a security target might
be practically infeasible even though it is theoretically pos-
sible. Hence, finding a security vulnerability does not imply
that it always can be exploited easily. Therefore, the pene-
tration tester’s objective and task is much broader and labor
intensive than that of an attacker.
When a successful penetration in the security target
is possible, then this provides evidence that the current
security measures are inadequate and need to be strength-
ened. In addition, when the penetration went unnoticed
by the security target, it shows that the intrusion detection
mechanisms do not provide an adequate level of security
assurance. On the other hand, when a penetration test
is not successful, it does not provide evidence that the
security target is secure. In the latter case, the penetration
test provides evidence that under the given test condi-
tions, the security target did not show obvious exploitable
security flaws.
A penetration test assumes the presence of a security
boundary, as the test is aimed at penetrating it. The secu-
rity boundary separates the internal components of the
security target from the external components (e.g., outside
world), and this separation is enforced by various security
measures. In general, a security target is composed of hard-
ware, software, and human components. Depending on the
human component, security assumptions are made and a
penetration test might also include human vulnerabilities
(e.g., social engineering).
In general, a penetration test assesses the state of the
security target at a given point in time, in contrast to
penetration tests based on monitoring techniques (e.g.,
intrusion detection). Hence, any change in the internal and
external environments might lead to new vulnerabilities,
which would require the execution of a new penetration
test. Therefore, in practice, certain types of penetration
tests based on monitoring techniques analyze security tar-
get events on a regular interval or even in real time, and can
search for anomalies that might indicate exploitable vul-
nerabilities. It should be noted that these penetration tests
profiles need to be updated on a regular basis.
A penetration test can be passive (observing) and active
(interact). The passive penetration test infers with the
existence of vulnerability of the security target in a non-
intrusive manner. The passive penetration test probes the
target boundary and scans for security weaknesses in the
target environment, without aiming at gaining access and
without adversely affecting its normal operation. Active
|
| |
