CTE22.IT.C3.E
Penetration Testing
Penetration Testing
Penetration Testing
Describe the tools and procedures used during the main phases of a penetration test.
Perform passive and active reconnaissance and analyze the results.
Examples: DNS lookups, identify technical and administrator contacts, cloud versus self-hosted, social media scraping, cryptographic flaws, company reputation and security posture, enumeration, website reconnaissance, packet crafting, defense detection, tokens, wardriving, network traffic, cloud asset discovery, detection avoidance, third-party hosted services
Use empirical data and evidence strategically to perform vulnerability scanning, social engineering and physical attacks, and post-exploitation techniques.
Examples: considerations and limitations of vulnerability scanning, scan identified targets for vulnerabilities, set scan settings to avoid detection, multiple scanning methods, Nmap, pretexting for social engineering or physical attacks, impersonation techniques, social engineering tools, methods of influence, post-exploitation tools, Pass the Hash, network segmentation testing, horizontal and vertical privilege escalation
Investigate common vulnerabilities and attacks against specific, specialized types of systems and report findings to peers.
Research attack vectors and determine the detailed steps used in performing network, wireless, application-based, and cloud-specific attacks based on experimentation data.
Examples: stress testing for availability, exploit resources, tools
Outline the key components of written reports regarding the procedures and results of penetration testing, and explain the importance of maintaining transparent communication during the entire penetration testing process.
Examples: report audience, report contents, length of storage time for report, secure distribution, note-taking and ongoing documentation during testing including screenshots, common themes, root causes, communication path and associated triggers, reasons for communication, goal reprioritization, presentation of findings
Analyze final penetration testing data and recommend appropriate remediation.
Examples: technical controls, administrative controls, operational controls, physical controls
Choose the most effective activities to be implemented after results are reported in relation to the client, post-engagement cleanup, attesting to findings, and the data destruction process.
Summarize the basic concepts of scripting and software development for offensive and defensive security purposes.
Examples: logic constructs, data structures, libraries, classes, procedures, functions
Analyze a script or code sample for use in a penetration test.
Foundations of Operating Systems
Foundational Standards
Incorporate safety procedures in handling, operating, and maintaining tools and machinery; handling materials; utilizing personal protective equipment; maintaining a safe work area; and handling hazardous materials and forces.
Demonstrate effective workplace and employability skills, including communication, awareness of diversity, positive work ethic, problem-solving, time management, and teamwork.
Explore the range of careers available in the field and investigate their educational requirements, and demonstrate job-seeking skills including resume-writing and interviewing.
Advocate and practice safe, legal, responsible, and ethical use of information and technology tools specific to the industry pathway.
Participate in a Career and Technical Student Organization (CTSO) to increase knowledge and skills and to enhance leadership and teamwork.
Use technology to collaborate with peers and/or experts to create digital artifacts that can be published online for a target audience.
Formulate new ideas, solve problems, or create products through the design and engineering process by utilizing testing, prototypes, and user feedback.
Operating Systems
Compare and contrast various operating systems.
Examples: Android iOS, Windows, Mac, Linux
Compare and contrast the functions of operating systems, environments, and platforms and explain how they are related.
Contrast different types of computer hardware platforms.
Examples: IBM PC hardware platform, Apple hardware platform
Research various types of operating systems (OS) and indicate the hardware platform(s) required for each system to perform well.
Examples: Xbox, Playstation OS and video game consoles; Windows, Linux OS, and standard computer platforms
Compare and contrast Windows and Linux file systems using a graphical user interface (GUI) and command line interpreter.
Explain how system processes work and how to manage them, using a flow chart.
Examples: executable file, memory/RAM
Describe the functions, structures, and evolution of operating systems.
Evaluate design choices and trade-offs in the implementation of different operating systems, and decide which type of operating system would be most appropriate for a given situation.
Explain data structures, algorithms, computer architecture, and programming in the context of operating systems.
Examples: simple structure, layered approach, modules, hybrid systems, microkernels
Installation, Configuration, and Administration
Install, configure, and upgrade desktop computer modules and peripherals, following established basic procedures for system assembly and disassembly in an actual or simulated environment.
Describe the functions of a computer’s main processing board.
Describe the purpose and functions of communication ports on standard computers and laptops.
Illustrate and explain the operation and purpose of hardware components using application software.
Examples: Describe hardware components in terms of device type, device functions, and interaction of components.