Identifying and Assessing Risk Factors to Lower Hazards in Cyber Security Penetration Testing

Abstract

Penetration testing is a rapidly growing field. In today's technological exposure to cyber-attacks, there is a need for easily understandable metrics of cyber-attacks and the impact that it causes on enterprises. The measurement metrics are significant challenges in assessing a cyber-crime incident or a penetration testing audit. There are so many factors in the cyber security field that a penetration tester must consider determining the risk of a particular event or attack. Without any measurement or metrics, there is a chance that the pentesters or penetration testing can get stuck in a bottomless pit without arriving at a defined result. A tool called CVSS attempts to calculate risk based on specific parameters. There are complex technicalities involved in arriving at a risk index to be understood by the board members of an enterprise to make an informed decision about the enterprise's cyber security plan.