What is Penetration testing?
In short
Penetration testing is an authorized simulated attack in which testers try to exploit weaknesses in systems, networks or people to show what a real attacker could achieve.
Key takeaways
- It goes further than a vulnerability scan, which only identifies known weaknesses.
- It needs written authorization and an agreed scope.
- Findings should be prioritized and remediation retested.
Where it's tested
ISC: Information Technology (IT) Audit & Advisory Services — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
An auditor plans to rely on an exception report generated by the client's ERP system. What must the auditor do before using it as audit evidence?