安全性测试

\u00a0<\/p>

Attack surfaces could include for example:<\/p>

• which ports are open to the computer (8080, 443, 1521 etc.)<\/li>\t
• how visible the computer is (is ICMP\/PING availalble, firewall access & which domain trusts can see it)<\/li>\t
• what permission sets are setup - which accounts can access it? parts of it? are these in line with best practices (i.e. OS administrator account with no password)<\/li>\t
• what folders are shared, what has read access, what has write access<\/li>\t
• is the OS and installed software patched upto date, are there known vulnerabilities with the these software as listed on popular, common security databases of attacks in the wild<\/li>\t
• for a given database, what level of server, database, table and security account permissions are setup. Are these in line with best practices (i.e. leaving the SQL Server \u2018sa\u2019 account enabled)<\/li>\t
• for a website login page, the tools will attempt various attacks like entering malformed SQL in the username & password fields to check for SQLi attacks, malformed javascript to check for XSS attacks and more<\/li><\/ul>

  The hard part isn\u2019t so much using these tools which do most of the stuff for you, it\u2019s investigating the results & writing an end vulnerability findings report. For that you need really expert security testing members who are highly trained & experienced. It\u2019s really not an easy role & like general network security, these members need to be constantly informed, constantly learning of new threats.<\/p>","quoteUsername":"alex_read","translations":{"Common":{"like":"Like","unlike":"Unlike"},"Forum":{"Quote":"Quote & Reply","Share":"Share"}}}">

  • 就像
  • 报价和回复