REVIEW OF PENETRATION TESTING METHODS FOR ASSESING THE PROTECTION OF COMPUTER SYSTEMS

Abstract

The most effective way to evaluate the security of the system is to conduct a penetration test (pentest). A penetration test is a simulation of an attack on a system, network, equipment, service, in order to demonstrate how vulnerable this system is to a real attack. During the test it is estimated how the system responds to the attack, regardless of whether it is possible or not to violate the protection of the system and what information can be taken out of the system. Subject. The paper focused on the study of the methods of penetration testing, analyzes the international standards of information security, examines the main methods of penetration testing computer systems. Results. It is necessary to check constantly the current state of the security of the computer systems in order to respond in a timely manner to new challenges for information security of state bodies, infrastructure objects on critical importance, commercial enterprises, institutions and organizations. The research substantiates the necessity of conducting this kind of work and gives the advantages of its application. The main approaches to testing are described in detail: WhiteBox, BlackBox, Graybox. The methods of testing systems are described and classified depending on the requirements of the customer, the objectives of testing, time limits and importance of the object under research. Since operating systems, programs, data protocols are constantly changing, penetration testing will not completely solve the problem of data protection, but it allows you to look at computer systems from the intruder’s point of view. And this allows to understand the weaknesses of the system and to take timely measures to prevent or significantly reduce possible losses. The choice of penetration testing methods should be performed after the customer has been identified the testing objectives, the definition of the systems to be tested, the definition of critical objects, the timing of the work, etc. Different combinations of testing methods and creative approach will allow to conduct testing the most qualitatively and in the shortest time, to make a report and to provide the customer with recommendations for improving the security of the system. Conclusions. A classification and algorithm for choosing penetration testing methods for evaluating the security of computer systems is proposed.