What exactly does VAPT do? NIST SP 800-115 Boundary for gap reduction assessment and penetration testing

The VAPT (Vulnerability Assessment and Implementation Test, Gap Assessment and Infiltration Test) is almost the most used and easily confused set of abbreviations. The purchase list contained “VAPT services once” and could have been delivered either by a bunch of scanning reports or by a real reset of intrusion routes - the difference between the prices and the value. This paper describes boundaries in the light of one of the most authoritative public approaches: SP 800-115 of the National Institute of Standards and Technology of the United States of America.

I. Boundary between VA and PT: NIST Point Broken

NIST's original statement is very direct:The leak scanner only checks that there may be a loophole, while the penetration test attack phase is actually used to confirm its existence.I don't know. This is the essential division of labour between the two:

• ギャップアセスメント(VA): Batch identification of hosts, services, applications, output of “how many holes, how serious” lists are compared to a loophole (e.g. NVD). The degree of automation and coverage was high, but the report was misreported and largely did not answer “how far these holes can go in combination”.
• 浸入試験(PT): Simulation of a real attacker, launching a real attack on a selected target. NIST stresses in particular that most penetration tests are worth finding out.Group of gaps in individual or multiple systems- 単一のループホールよりも大きいアクセス。

一つの文:VA is a medical check-up, PT is a real-person exercise.I don't know. Both types of procurement are often packaged in the compliance scene, but it must be clear at the time of receipt and inspection: has the validation actually been used? Or did Nessus just hand over the export forms?

II. NIST IV METHODOLOGY

SP 800-115 セクション 5.2.1 は 4 つの段階(図5-1)にろ過テストを分けます:

• 計画スキームIdentification rules, obtaining management approval and writing down, setting test targets. NIST specifies:この段階では実際のテストはありません。しかし、それは全体のテストの基礎です。
• 発見された発見: Information gathering and gap analysis. Port and service identification, DNS/WHOIS query, Banner grab, NetBIOS enumerator (internal testing only); then compare what has been cleaned to the loophole. It's only slow for a man to catch a new glitch from the scanner.
• 攻撃攻撃攻撃: The core of the test. The potential gaps that have been identified are being used on a case-by-case basis; success is being verified with a clear response to mitigation measures; when power is being used, the real risk level of the network continues to be analysed; and a particular loophole is not moving. Between the attack and the discovery,フィードバック リング— Once the new foothold has been secured, it will be collected, retested, multiple system rolling tests.
• 報告書: Not the last, but the last.Synchronize with the other three phasesThe border check record.

NIST also reminds that this is only an “acceptable division”, but industry mainstream processes (including the OWASP WSTG and PTS standards) can be matched to this skeleton: the OWASP Web Safety Test Guide is a Web application test of the de facto public manual, and PTES has written up the six-part community standard for pre-interaction/intelligence collection/threat modelling/use/after-use/reporting.

III. Overt or Covert: Prefixing the rules of the game

NISTは、知識レベルに応じて2つのカテゴリに安全性試験を分割します。積み過ぎテストConducted with the knowledge and consent of the IT team, with the aim of finding as full a hole as possible;カバルト(ブラックハット)対立試験The defense is not notified, and the real confrontation organization is examined for the damage it can cause, and the response is tested. The two objectives are completely different and do not use a scanning report to claim both effects. In any case,Rules of engagement first.: scope, time period, prohibited actions (e.g. DoS, delete production data), cessation conditions, emergency contact, all written - NIST Appendix B directly to the ROE template. Infiltration tests naturally involve real systems and real data, with no ROE "infiltration tests" amounting to an unlicensed homicide.

IV. THREE ENJOYMENTS TO A AND B

A-A-A-A-Rの特長1) reports are required to distinguish between “scan discovery” and “validated use”, which is the only one worthy of high-risk conclusions; 2) focus on combination paths and final landing points (domain control? Database?) instead of CVSS average score; 3) check the scope of the test with ROE to cover cloud assets and API.

Professional position B(1) The Plan stage does not do anything without obtaining written approval, NIST writes this sentence in section I of the methodology; (2) the report is synchronized, with the cut-off, time-line, and recovery steps being kept on-site, and the subsequent recording is a mass disaster; and (3) the three main categories named by CVE-NIST are only misconfiguration (especially unsafe default values), internal nuclear defects, buffer zone spills, and most of the lines of defence in actual projects are the first.

Source: NIST SP 800-115 (2008-09), csrc.nist.gov/pubs/sp/800/115/final, PDF Sections 2.4.2, 4.3, 5.2.1 and Appendix B/F; cross-certificate: owasp.org WSTG project page, Pentest-standard.org. The definitions and assertions in the text are identified in the corresponding section of the original text.