What is the value of performing exploits against systems Alo

What is the value of performing exploits against systems? Along those lines, what do you consider to be the ultimate goal of a penetration test? Can you stop short of actually exploiting? How does exploiting get you to remediation?

Solution

Assets are anything that we determine to have value of performing exploits against systems. An asset\'s value can be tangible eg. gold and jewelry are tangible assets, as are people.

The exploitation phase of a penetration test focuses primiraly on establishing access to a system or resource by bypassing security restrictions. If the prior phase, vulnerability analysis was performed properly, this phase should be well planned and a precision strike. The main focus is to identify the main entry point into the organization and to identify high value target assets.

Countermeasures are defined as controls that hinder the ability to succesfully complete an exploit avenue. This technology could be Host based intrusion prevention system, security guard, web application firewall, or other preventive methods. When performing exploit, several factors should be taken into consideration. In the event of a preventative technology, a circumvention technique should be considered. In circumstances when it is not possible, alternative exploit methods should be considered.