Penetration Testing: A guide for business and IT managers

by Nick Furneaux, James Hayes (Editor), Jims Marchang, Rob Ellis, Jason Charalambous

Overview

Penetration testing is the attempt to professionally break in to an organisation's computer systems, with the goal of determining whether the systems are secure. This guide for business and IT managers, developed in collaboration with CREST, explains the process of penetration testing and the benefits it brings. The book provides essential insight and tips for setting up a penetration testing programme, maintaining it, and responding to the results of penetration tests.

Product Details

ISBN-13:	9781780174105
Publisher:	BCS, The Chartered Institute for IT
Publication date:	09/11/2019
Sold by:	Barnes & Noble
Format:	eBook
Pages:	150
File size:	3 MB

About the Author

The BCS-CREST penetration testing working group are all penetration testing experts from across the security industry. From penetration testers and consultants, to university lecturers specialising in information security, to information security managers, they all have insight to share on preparing, carrying out, and responding to penetration testing.

Table of Contents

1. What is penetration testing?
2. Successful penetration testing: an overview
3. Regulatory management for penetration testing
4. Embedding penetration testing within organisational security policies and procedures
5. Outcome-led and intelligence-led penetration testing
6. Scoping a penetration test
7. Penetration test coverage and simulating the threat
8. Building organisational capability for penetration testing
9. Commissioning penetration tests 
10. Selecting tools for penetration testing
11. Good practice for penetration testing
12. Role and coverage of reporting
13. Interpretation and application of report outcomes
14. Acting on penetration test results 

Editorial Reviews

"This book demystifies the process of penetration testing, making sure buyers of this service get the most value from the engagement. Due to its plain language it is applicable to non-technical readers as well as IT professionals. It can be used as an awareness tool for the company, with everyone involved in the system development/operational lifecycle, including the asset owner. Definitely worth reading!!

CISO, Arqiva - Denis Onuoha

'A useful introduction to the practice of penetration testing.'

Software Engineer, IBM Cloud Hyper Protect Services - Dave Hay

"This is the first time I’ve encountered a book which manages to combine properly researched good practice for penetration testing with the real requirements of the business community...The authors really know their stuff and I found myself nodding and smiling many times in every chapter. The case studies and examples are pithy and highly relevant. Concepts such as red teaming and intelligence-led penetration testing are clearly explained and contrasted with other forms of testing, helping demystify this complex topic. Each chapter is well laid out and the guidance provided is exactly what managers need to know to get great value from security testing exercises of all types. Over a dozen expert authors have contributed to this book and the results speak for themselves – this is a must read for those responsible for information security in organisations of all sizes."

Partner, Naturally Cyber LLP and Founder, First Base Technologies LLP - Peter Wood FBCS CITP CISSP M.Inst.ISP

'How do you deliver and get real value out of penetration testing? How do you access and utilise available skills and services to intelligently manage risk, focusing on threats and continuous protection of valuable assets?

There are plenty of great books covering technical aspects of penetration testing. This book mainly avoids those, focusing more on its organisation and execution. It points to the guidance of respected organisations, such as CREST and SANS, enabling deeper reading. It highlights red teaming and intelligence-driven approaches - these mature testing, enabling fine-tuning of organisational defences. Coverage includes traditional information systems and cloud services, and assurance within agile delivery methods.

I would have liked to have had this book to hand when I started in infosec twenty years ago. It’s a useful reference for managing penetration testing as part of wider information security programmes, and when setting up or running cybersecurity capabilities for clients.'

Director, Fusion Cell - Robert J. Lockwood MSc