CoreQ Academy1.3 Compare and contrast testing frameworks and methodologies.
Frameworks make tests consistent and defensible. Know what each one is for.
Methodologies
- Open Source Security Testing Methodology Manual (OSSTMM)
- A peer-reviewed methodology for measuring operational security across human, physical, wireless, telecom and data networks.
- Council of Registered Ethical Security Testers (CREST)
- An accreditation body for penetration testing companies and individuals with defined standards of conduct and methodology.
- Penetration Testing Execution Standard (PTES)
- Seven phases: pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation and reporting.
- MITRE ATT&CK
- A knowledge base of real adversary tactics and techniques used to plan tests and map findings to detections.
- Open Worldwide Application Security Project (OWASP) Top 10
- The most critical web application security risks, a common baseline for web tests.
- OWASP Mobile Application Security Verification Standard (MASVS)
- Security requirements for mobile apps, with the companion testing guide (MASTG).
- Purdue model
- A layered reference model for industrial control networks (levels 0-5) used to scope OT tests and segmentation.
Threat modeling frameworks
- Damage potential, Reproducibility, Exploitability, Affected users, Discoverability (DREAD)
- A scoring model rating threats on five factors.
- Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege (STRIDE)
- A Microsoft model for categorising threats per component.
- Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)
- A risk-based, organisation-focused assessment method from Carnegie Mellon.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 1.3 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.