Paper Example on OSSTMM: Comprehensive Security Testing Methodology Guide

The Open Source Security Testing Methodology Manual is an unlocked grade technique for executing security tests. It is the most widely utilized, peer-evaluated, comprehensive safety assessment methodology in the market. OSSTMM deals with the technical information of the item being tested, the activities to be done during a security test, and determines the type of security test to be done. The OSSTMM promotes the evaluation methodologies for six distinct security areas. The areas tested include process security, communication security, information safety, physical security, wireless safety, and Information Technology safety. It was developed to improve testing of security at an enterprise for computing purposes. It has expanded further to ensure compliance and integrity needed for assessing safety in an enterprise. OSSTMM focuses on penetration testing, also called ethical hacking. Ethical hacking involves the examination of a system to check for inconsistencies and vulnerabilities.

Is your time best spent reading someone else’s essay? Get a 100% original essay FROM A CERTIFIED WRITER!

Save 25%

The interactions in OSSTMM include porosity, FFP, and echo process. Porosity involves the knowledge of how to protect the system from attack. The four-point process is the need to monitor and assess the activities deeply. The echo process is the simplest level of analysis in which interacts directly with a system that helps in discovering and understanding it. It needs access connection on the aim location and assessing the relationship on the aim position and evaluating the products. It creates the cause and effect form of verification. The four-point process involves four processes. Induction directs the target from the first area. Inquest determines the indicators of the signal because a signal in a system comes from the origin of its interaction. Interaction creates echo tests which involve unexpected and expected connection with the target to stimulate a reaction. Intervention interrupts the target using resources that create an extreme condition for the goal to continue operating.

In conclusion, the OSSTMM analysis probe encompass most of the ten concepts in security recognized by ISC. They are divided into five security section. Firstly, human security which assesses personnel security awareness and security training effectiveness in the company. The issues checked to revolve around attacks in social engineering and evaluating the amount of exposed sensitive information about the company and its employees. The second section is physical security, which tests security methods, access controls and physical location of structures. Thirdly, telecommunications which encompass different transmission channels in the company such as voicemail, PBX and VoIP. Fourthly, wireless communications that involve the various forms of wireless connection running the risk of disruption or interception. Lastly, Data networks are a channel that deals with system and computer security. Data networks describe network examining and recording, authentication, identification, spoofing, access method, phishing, service observation, and resource misuse.

References

Falgun Rathod. (2016). Open Source Security Testing Methodology Manual - OSSTMM. Retrieved from https://www.slideshare.net/falgun911/open-source-security-testing-methodology-manual-osstmm-by-falgun-rathod

Institute for Security and Open Methodologies (2017) Open Source Security Testing Methodology Manual (OSSTMM) [online] available from http://www.isecom.org/research/osstmm.html [10 April 2019]

Importance of Planning a Pentest

A penetration test is conducted to determine any vulnerability and to circumvent the security threat to a system component. The test is simulated attacks towards a controlled environment done by an outsourced security specialist who uses the same methods attackers outside the organization can employ. Since all organizations require additional steps to better their security, the test will identify any weaknesses and determine the allocation of resources meant to improve organizational security. Planning a penetration test has significant importance on strengthening the organization's security. The Pentest provides security personnel an alternative real-life experience of circumventing an attack. It tests the effectiveness of the security policies and uncovers any part of the security policy that might be missing. It provides a method of evicting an attacker from the organization's systems. It prevents damages to the system when trying to remove an attacker from the system.

The results of the pen test provide feedback on the risk routes to be used by the attacker into an application or the company`s system. It reveals all the vulnerabilities in the order that the security or development team did nor consider. The report from the Pen test gives recommendations on preventing any future occurrence of a threat to the security investment. The penetration tests can be used by developers to create fewer mistakes. When developers observe an outside attacker entering into an application they developed, they will be challenged to improve the security system hence preventing future similar attacks. Planning for a Pen test in organizations that require compliance with industry regulations and standards helps to avoid hefty fines. Ongoing Pen tests usually bi-annual or quarterly, demonstrate the security of information due diligence. The test should also be done on new systems and software added to the organization. The analysis provides information on security controls in place and supports the need for additional investment in updating the security technology and personnel to executive management and stakeholders.

In conclusion, Pen tests are conducted regularly to identify the system vulnerabilities, prioritize the feedback depending on the exploitability level of the vulnerability and the effect. It will help in facilitating compliance with strict regulations and standards that legitimize security update spending to the management and the board. Regular Penetration tests enhance the company security system creating an organization-wide, comprehensive program. For proper protection of information against intrusions and breaches, firms need to bolster their security defense for absolute protection.

References

Katharina Gerberding. (2017, March 14). 4 Good Reasons Why You Need to Conduct a Penetration Test. Retrieved from https://www.hitachi-systems-security.com/blog/4-good-reasons-why-you-need-to-conduct-a-penetration-test/

Security Innovation Europe Ltd. (n.d.). What is Penetration Testing and Why is It Important? Retrieved from https://www.securityinnovationeurope.com/blog/page/what-is penetration-testing-and-why-it-important#targetText=The%20purpose%20of%20a%20penetration,or%20organisation%20as%20a%20whole