Look inside

Penetration Testing

A guide for business and IT managers

By (author) Nick Furneaux, Jims Marchang, Rob Ellis, Jason Charalambous, Moinuddin Zaki, Peter Taylor, Roderick Douglas, Felix Ryan, Ceri Charlton, Gemma Moore, Tylor Robinson, Sharif Gardner Edited by James Hayes

Publication date: 11 Sep 2019

Penetration testing is the attempt to professionally break in to an organisation's systems by exploiting any vulnerabilities, with the goal of determining whether an organisation's IT systems and resources are secure. As hackers and would-be cyber attackers become increasingly more brazen, penetration testing has become an essential practice. This BCS guide for business and IT managers, developed in collaboration with CREST, explains the process of penetration testing and the benefits it brings. With contributions from practising penetration testers and information security experts, the book brings together a wide range of expertise, insight, and tips for setting up a penetration testing programme, maintaining it, and responding to the results of penetration tests.
View in the BCS Library
The BCS-CREST penetration testing working group are all penetration testing experts from across the security industry. From penetration testers and consultants, to university lecturers specialising in information security, to information security managers, they all have insight to share on preparing, carrying out, and responding to penetration testing.

Dimensions: 244x170mm

Print ISBN-13: 9781780174082

Ebook ISBN-13: 9781780174105

172 pages

Imprint: BCS, The Chartered Institute for IT

  1. What is penetration testing?
  2. Successful penetration testing: an overview
  3. Regulatory management for penetration testing
  4. Embedding penetration testing within organisational security policies and procedures
  5. Outcome-led and intelligence-led penetration testing
  6. Scoping a penetration test
  7. Penetration test coverage and simulating the threat
  8. Building organisational capability for penetration testing
  9. Commissioning penetration tests 
  10. Selecting tools for penetration testing
  11. Good practice for penetration testing
  12. Role and coverage of reporting
  13. Interpretation and application of report outcomes
  14. Acting on penetration test results 
"This is the first time I’ve encountered a book which manages to combine properly researched good practice for penetration testing with the real requirements of the business community...The authors really know their stuff and I found myself nodding and smiling many times in every chapter. The case studies and examples are pithy and highly relevant. Concepts such as red teaming and intelligence-led penetration testing are clearly explained and contrasted with other forms of testing, helping demystify this complex topic. Each chapter is well laid out and the guidance provided is exactly what managers need to know to get great value from security testing exercises of all types. Over a dozen expert authors have contributed to this book and the results speak for themselves – this is a must read for those responsible for information security in organisations of all sizes."

Peter Wood FBCS CITP CISSP M.Inst.ISP
Partner, Naturally Cyber LLP and Founder, First Base Technologies LLP

"This book demystifies the process of penetration testing, making sure buyers of this service get the most value from the engagement. Due to its plain language it is applicable to non-technical readers as well as IT professionals. It can be used as an awareness tool for the company, with everyone involved in the system development/operational lifecycle, including the asset owner. Definitely worth reading!!”

Denis Onuoha
CISO, Arqiva

'How do you deliver and get real value out of penetration testing? How do you access and utilise available skills and services to intelligently manage risk, focusing on threats and continuous protection of valuable assets? There are plenty of great books covering technical aspects of penetration testing. This book mainly avoids those, focusing more on its organisation and execution. It points to the guidance of respected organisations, such as CREST and SANS, enabling deeper reading. It highlights red teaming and intelligence-driven approaches - these mature testing, enabling fine-tuning of organisational defences. Coverage includes traditional information systems and cloud services, and assurance within agile delivery methods. I would have liked to have had this book to hand when I started in infosec twenty years ago. It’s a useful reference for managing penetration testing as part of wider information security programmes, and when setting up or running cybersecurity capabilities for clients.'

Robert J. Lockwood MSc, CISSP, CISM
Director, Fusion Cell

'A useful introduction to the practice of penetration testing.'

Dave Hay
Software Engineer, IBM Cloud Hyper Protect Services