ペネトレーションテストとは
ペンテストがアタックサーフェスの弱点を検出する仕組み
Penetration testing is a process to get insight into security weaknesses within your attack surface. Unlike a vulnerability assessment program, which is an ongoing process, pen tests provide a point-in-time picture into your cyber health. Pen tests can help define ways to reduce cyber risk and build stronger vulnerability assessment practices.
レポートの詳細内容:
How to Make Pen Tests More Effective
Exposure management best practices can improve the effectiveness of your pen testing processes.
詳細はこちらからペンテストに関する Tenable Community
ほかのペンテスターの方々と交流されたいですか? Tenable Community は、アドバイスの取得、アイデアの共有、質問などに最適な場所です。
詳細はこちらから脆弱性スキャンとペンテストの連携
Vulnerability scanning is a key component of your overall penetration testing processes.
詳細はこちらからMaximize Your Penetration Tests with Tenable
Tenable supports penetration testing by automating processes to quickly discover security weaknesses so you can decrease cyber risk.
How are Penetration Testing and Vulnerability Scanning Different?
ペネトレーションテストと脆弱性スキャンは補完プロセスですが、同じものではありません。
ペンテストでは、アタックサーフェス内の弱点が検出され、攻撃者がシステムへの不正アクセスに成功して、ネットワークや資産に侵入できるかどうかを判断できます。
Pen tests are generally conducted by an experienced and well-trained third-party, who may use a variety of techniques to uncover and exploit these weaknesses just like an attacker would.
While a penetration test is a point-in-time assessment of vulnerabilities across your environment both on-prem and in the cloud, vulnerability scanning seeks out known security issues and misconfigurations within your attack surface so you can plan remediation to reduce your organization’s cyber risk.
決済カード業界のセキュリティ標準 (PCI DSS) などの規制機関やコンプライアンス機関は、定期的なペネトレーションテストと脆弱性スキャンの実施を要求する場合があります。しかし、2 つの違いを理解していない企業もあります。
In this pen test guide, learn more about the differences between pen testing and vulnerability scanning to better understand how both are critical components of a mature and effective overall cybersecurity program.
Tenable Community: Your Go-To Resource for Pen Testing
ペネトレーションテストを専門とするサイバーセキュリティ担当者の方や、 ペンテストのリソース、ツール、ベストプラクティスに関する質問がある方は、 Tenable Community を利用して、他の専門家たちとつながり、ペンテストや関連するトピックについて話し合うことができます。
今、次のような会話が交わされています。
Penetration Testing for all of my Public IPs?
We have bought the Nessus Professional scanner. We have to perform penetration testing to all our public IPs. Are there recommended plugins or a plugin family for me to choose? Also required to run vulnerability assessment for all my applications.
続きを読むVulnerability Scan vs Penetration Testing
We conduct periodic vulnerability assessments and take measures against vulnerabilities. Would this be a countermeasure if a penetration test is performed? What vulnerabilities or security risks, if any, are not detected by the vulnerability assessment and are first discovered by penetration testing?
続きを読むCIS Control 20: Penetration Tests and Red Team Exercises
As a final testament to a good security program, CIS Control 20 recommends testing all security controls. These exercises are very beneficial to training and security awareness. Many times, attackers can exploit well-intended measures. For example, a really strict password policy can result in users taping passwords to their keyboard.
続きを読むペネトレーションテストに関するよくある質問
ペネトレーションテストとは何ですか?
ペンテストの仕組みはどのようなものですか?
ペンテストの目標は何ですか?
ペンテストはどれくらいの頻度で行うべきでしょうか?
なぜペンテストが重要なのですか?
脆弱性評価とペンテストはどう違いますか?
How is penetration testing different from vulnerability management?
ペンテストにはどのようなフェーズがありますか?
ペンテストには他のアプローチがありますか?
ペネトレーションテストのベストプラクティスとはどのようなものですか?
Some pen testing best practices are:
- Conduct tests at least quarterly and as required to meet compliance standards.
- Set goals, objectives and scope before conducting each pen test.
- Review results to plan for remediation.
- Follow up with additional tests as needed.
- Retain evidence uncovered by your pen tests, taking into account related laws and compliance standards for evidence retention.
脆弱性スキャンはペンテストでどのように使用されますか?
脆弱性スキャンとペンテストの連携
ペンテストは、アタックサーフェス内の弱点を攻撃者に悪用される前に検出するためのプロセスです。 しかし、どこから始めればよいでしょうか?
脆弱性スキャンから始めることをお勧めします。 脆弱性スキャンは、ペンテストのプロセス全体の重要な要素です。 脆弱性スキャンを使用すると、アタックサーフェスの弱点をすべて検出し、攻撃者が悪用してデータやシステムにアクセスする前に修正できるようになります。
脆弱性スキャンとペンテストは、次のように連携します。
During a penetration test, your tester may perform vulnerability scans across your complete attack surface or choose to specifically target a subset, for example your internal networks, external networks, your cloud environments, internet of things (IoT) devices, industrial internet of things (IIoT) devices, operational technology (OT) devices, containers or web apps.
Nessus Professional は、脆弱性スキャンを支援する脆弱性評価ツールです。 It comes with pre-built templates to help you conduct authenticated and non-authenticated vulnerability scans. It can help you quickly — and easily — conduct both whitebox testing and blackbox testing.
Nessus templates support many compliance frameworks such as Center for Internet Security (CIS), Health Insurance Portability and Accountability Act (HIPAA), Defense Information Systems Agency (DISA), Security Technical Implementation Guides (STIG), and others.
また、検出漏れや誤検出を避けるための設定を含め、テスト用に Nessus テンプレートをカスタマイズすることもできます。
ペンテストの一環として脆弱性スキャンに Nessus を使用する方法についての詳細は、以下からご確認いただけます。
続きを読むNessus は脆弱性評価で業界 No.1
現代のアタックサーフェスの脆弱性と資産は常に変化しています。 攻撃者の機先を制するには、Nessus Professional にお任せください。
ペンテストに関するブログ記事
エクスポージャー管理によりペネトレーションテストをより効果的にする
Unfortunately, many times organizations will prioritize addressing compliance requirements and issues over developing proactive and preventive security approaches, like vulnerability scanning and penetration testing. If that's your organization's approach, you may never fully address your cyber risks, especially because attackers are constantly on the hunt for vulnerabilities in your system. Learn more about how you can apply exposure management best practices to your pen test processes to make them more effective.
Discover the Most Valuable Cyber Skills, Key Cloud Security Trends and Cyber’s Big Business Impact
Although there continues to be an ongoing shortage of skilled cybersecurity professionals, it’s good to know these skills remain in high demand. In fact, after taking a closer look at Foote Partners’ data about tech skill market value, those interested in penetration testing careers might rejoice in finding that for penetration skills, the average pay premium is 17% of the base salary equivalent, and the market value increase is more than 21%. Read more to find out about pen test value in this changing market.
Tenable Nessus Expands Attack Surface Coverage with Web App Scanning
Unsecure web apps can lead to data breaches with devastating consequences. Yet, as penetration testers know all too well, keeping up with keeping up with all the latest vulnerabilities and other potential attack methods is challenging. Far too long, testers have piecemealed different tools to try to address as many potential issues across an attack surface as they can. Read more about how a unified solution can help testers get a more comprehensive picture and overcome challenges commonly caused by siloed solutions.
Maximize Your Penetration Tests with Tenable
Penetration testing and vulnerability assessments are the perfect pair to use in tandem to mature your cybersecurity practices. Both of these processes seek out weaknesses in your attack surface. While automated vulnerability assessments can help you quickly identify some of these most common security issues, you can’t overlook the added value of a pen tester's skills and creativity to think just like an attacker and mimic steps they may take to access your environment.
Focus on Active Scanning
Active scanning, a core component of Nessus Professional, a part of the Tenable One Platform, is a great way to complement your existing pen testing practices. For example, if you’re looking for an exploit within a website, you can use a web application scanner to find specific ways your internet-facing applications are vulnerable to attacks. Once identified, you can put your pen test skills to work to explore these issues in greater detail.
Save Time
Automated vulnerability scans can quickly identify areas where you should focus your pen testing activities. For example, if you conduct a scan and discover that a client’s Apache framework has a security issue, you can focus on demonstrating how an attacker might exploit that issue and then offer a remediation solution.
Conduct Offline Assessments
While internet-facing assets are often front-of-mind for potential attacks, your offline assets are at risk too. With the support of Nessus Professional’s Live Results, for example, as part of your penetration testing, you can perform offline vulnerability assessments every time a plugin is updated. If something suspicious pops up, you get an alert and can focus pen testing steps from there.
No.1 の精度
Nessus は、シックスシグマ (6σ) の精度を持ち、100 万回のスキャンで 0.32 のエラーという、業界で最も低い誤検出率を記録しています。
No. 1 のカバレッジ
Nessus は 14 万種以上のプラグインを備えており、5 万件以上の CVE (Common Vulnerability Exploit) に対応しています。 Tenable では、毎週 100 種類以上の新規プラグインをリリースしており、重要な脆弱性について情報開示から 24 時間以内に対応しています。
No. 1 の導入件数
世界中の数万にも及び企業や組織が Nessus を信頼しています。ダウンロード数は 200 万を超えており、フォーチュン 500 の半数の企業によって利用されています。