Testing Enterprise Security

Companies need to make sure that the security appliances and security measures they implement are enforced and working perfect. Different types of security testing and often conducted in order to make sure that everything is perfect. Many of the security tests are often some type of attack to the enterprise network to check that the network is not yielding to that attack. Since network security testing also involves some attack against the company network, you have to make sure that policy allows for these types of internal tests to be run. Also you must have a written permission to conduct these tests.

Some of the common tests which are performed to test the enterprise network security are

• Vulnerability scanning: When all the systems are up and the network has started functioning in the network, we have to check for the vulnerabilities which may present in the enterprise network which can be exploited by an attacker. By conducting vulnerability scanning on all the enterprise systems we can get information about the vulnerabilities and the risks associated with it. Most widely used vulnerability scanner is Nessus. Nessus was originally developed for UNIX, but it is ported into Windows and Linux Operating Systems. Vulnerability scanner identify vulnerabilities within the enterprise network. Click the following link to visit Nessus website.

• Penetration testing: Penetration testing is an active attack to a target system to find out whether the target machine is yielding . Penetration tests can be done with testers have no knowledge about the network to be tested or with testers with complete knowledge about the network to be tested. Penetration testing can also be external and internal. An external Penetration testing can target machines outside the network perimeter, usually via internet and internal Penetration testing are performed on the network from within the organization. Metasploit and Kali Linux (formerly known as Backtrack Linux) are the main tools which are used for Penetration testing.

• Network scanning: Network scanning us useful in identifying the up IP addresses and open ports in computers and servers. The main tool used for network scanning is namp.

• Password cracking: A password cracking is an testing method using programs designed to test whether attackers can decrypt passwords or disable password protection. Password cracking attacks use dictionary attacks or brute-force attacks to crack passwords. Dictionary attack is to generate and test a list of potential dictionary based passwords that used commonly as passwords. If dictionary based attacks are not yielding, then the user may be using a strong password (different combination of alpha numeric and special characters in password), then brute-force password cracking test can be used. Brute-force password cracking test try every possible combination of letters, numbers, and special characters to crack the password.

• Social engineering: Social Engineering attack tests the security and integrity of the employees by using the interactive communication skills to gather information which can be used for an attack. By using Social Engineering attack tests we can identify the social engineering vulnerability of employees and train them better.