Security Testing Essential Training

Introduction

• The importance of security testing
• What you should know

1. Understanding Security Assessments

• Language is important
• Risk assessments
• Calculating risk score
• Security controls assessments
• NIST and ISO
• Compliance assessments
• Vulnerability assessments
• Penetration tests
• Goals of a pen test
• The security assessment lifecycle

2. Your Testing Environment

• The security tester's toolkit
• Kali Linux
• Nmap
• Nessus
• Wireshark
• Lynis
• Demo: Lynis
• CIS-CAT Lite
• Aircrack-ng
• hashcat
• OWASP ZAP
• Demo: OWASP ZAP
• Prowler

3. Planning Your Assessment

• Understanding your scope
• Improving over time
• Selecting your methodology
• Selecting your tools
• Basic assessment tools
• Advanced assessment tools

4. Review Techniques

• Documentation review
• Log review
• Log management tools
• Ruleset review
• System configuration review
• Demo: CIS-CAT
• Network sniffing
• Demo: Wireshark
• File integrity checking

5. Identifying Your Targets

• Network discovery
• Open source intelligence
• Network port and service identification
• Demo: Nmap
• Vulnerability scanning
• Determining severity
• Demo: Nessus
• Wireless scanning
• Wireless testing process
• Demo: Aircrack-ng
• Demo: Prowler

6. Vulnerability Validation

• Password cracking
• Demo: Hashcat
• Penetration test planning
• Penetration test tools
• Penetration test techniques
• Social engineering
• Demo: Social‑Engineer Toolkit (SET)

7. Additional Considerations

• Coordinating your assessments
• Data analysis
• Providing context
• Data handling
• Drafting your report
• Delivering your report

Conclusion

• Next steps
• Additional resources