Penetration testing
Penetration testing is an authorized security assessment that simulates attacks against systems to identify and demonstrate exploitable weaknesses.
Rules of engagement: An agreement that defines an assessment’s scope, permissions, methods, and limits. They establish which simulated attacks are authorized and how the test must be conducted.
Information security: The practice of protecting information and systems from unauthorized access, alteration, disclosure, or disruption. Penetration testing is one way to assess whether security protections withstand attack.
Vulnerability assessment: A process for identifying and prioritizing security weaknesses, often using automated tools. It seeks broad weakness coverage, while penetration testing validates selected weaknesses through attack.
Web application security: The practice of protecting web applications from attacks and security weaknesses. Web application tests examine risks such as broken access controls and injection flaws.
Responsible disclosure: A coordinated process for reporting vulnerabilities to affected organizations and limiting premature disclosure. It provides a safe route for communicating serious findings beyond the immediate assessment team.
Reconnaissance: The collection of information about a target before attempting to exploit it. It maps exposed assets and likely attack paths before active testing begins.
Threat modeling: A structured process for identifying assets, threats, attack paths, and security requirements. It helps align test scenarios with plausible threats to the system.
Red team: A group that simulates an adversary to test an organization’s people, processes, and defenses. Red-team operations often pursue stealth and organizational objectives beyond a scoped penetration test.
Network security: The protection of computer networks and their connected systems from unauthorized access and disruption. Network penetration tests assess exposure across hosts, services, and network boundaries.
Remediation: The correction or reduction of a security weakness and its associated risk. Fixing validated findings is the practical outcome that makes an assessment useful.