Guideline on network security testing

Abstract

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security, and its collaborative activities with industry, government, and academic organizations.

Testing Production Systems Safely: Common Precautions in Penetration Testing

“…They proposed to analyze computer networks from the perspective of an attacker. Highly disputed in the beginning, penetration testing is now an established procedure in information security [5], [6].…”

Security in software defined networks

“…In general, software flaws are notoriously difficult to discover and are often the root cause of major system disruptions and outages. Therefore, writing bug-free and reliable software remains a critical challenge [181]. Due to the 'softwareisation' of networks in SDN, the problems of software design and implementation flaws become an increasingly critical security threat.…”

finding multi-step attacks in computer networks using heuristic search and mobile ambients

“…There is a feedback loop between Attack and Discovery, since exploitation leads to more discovery. Besides, the attack phase itself can also be iterative because one successful exploitation might open opportunities for further exploitations [217]. Hackers toolkits and detailed instructions about exploitations found in specialized forums like www.securityfocus.com play an important role at this stage.…”

“…It is usually performed internally, by employees organized on a so called Blue Team [217]. On the other hand, a covert pen test happens when only the upper management responsible for the initiative has full knowledge about the testing.…”

“…In this case, testers are provided with a minimum, publicly available, set of information about the target under evaluation, and need to acquire the remaining information needed to launch attacks the same ways as remote, non-employees do [81]. The first stage testers have to bridge is to identify a way-in the network firewall and then, if successful, they can attempt to reach, interactively, other hosts within the network [217]. Alternatively, a white-box type of test is more appropriate to simulate attackers from insiders.…”