2008年1月21日 星期一

Security Test

Security test can be conducted in two approaches:
  • Black-box
    This means the ethical hacker has no prior knowledge or information about the system. This simulate a true web-hacking, beginning with nothing but the company name. From here the ethical hacker gathers information about the network and the business from as many outside source as possible.
  • White-box
    This means the ethical hacker has complete knowledge of the network infrastructure to be tested. This help ethical hacker adopt a structured and formal approach. However, a good ethical hacker will also test the validity of the information provided initially, rather than work under the assumption that it is true.
It is considered by some security expert that the black-box testing is closely intimate a real web hacking. However, this need not hold good as script kiddies can easily know detail of the network and operating system and run scripts to exploit vulnerabilities. More often that not, the attacker is no total stranger to the system. He as access to insider information or may be he is an insider. Many organizations are subject to attack from internal sources where full system knowledge can be assumed.
If monetary resource and time are constraint, black box testing may not be the best option. This is where the organization may consider internal testing.
All forms of security testing can be of value to the organization; however it is up to the organization to decide what work in best of its interest under the given circumstance. A black-box test may highlight how supposedly confidential information is leaked. A white-box test is likely toe dedicate more time to probing for vulnerabilities and will address security of all external connection.

沒有留言: