Analysis of penetration testing standards and methodologies
Relevance. At present, the issues of security of information systems of critical infrastructure objects are becoming important. At the same time, the current tasks of the audit of information security (IS) of critical infrastructure objects, as a rule, are limited to checking them for compliance with IS requirements. However, with this approach to auditing, it often remains unclear the resistance of these objects to real attacks by malefactors. To check such stability, objects are subjected to a testing procedure, namely, penetration testing. Analysis of domestic publications in this area shows that there is no systematic approach to penetration testing in domestic practice. In this regard, it is relevant to analyze and systematize the best foreign approaches and practices for penetration testing. The purpose of this paper is a comparative analysis of existing foreign and domestic penetration testing techniques and standards. Results. The article presents the results of the analysis of the following foreign standards and methods: OSSTMM, ISSAF, OWASP, PTES, NIST SP 800-115, BSI, PETA, PTF, as well as the domestic method Positive Technology. The elements of novelty of the paper are the identified features, advantages, disadvantages and the scope of applicability of existing standards and penetration testing methods. Practical significance. The material of the article can be used to form the initial data, the sequence of stages and their content, in a practical audit of the security of information systems of critical information infrastructure objects by penetration testing.