Análisis comparativo de metodologías para pruebas de penetración mediante metodologías ethical hacking

Abstract

The techniques, concepts and methodologies associated with pentesting and most of the technological advances, the explosive growth of the internet has a dark side that is hackers. The natural escalation of offensive threats against defensive measures has shown each time that there are no systems that can be built and that these are not vulnerable to attack. Some studies have explored methods to carry out penetration tests, there is a great lack of standards that are flexible for carrying out the same. When we talk about ethical hacking, many times we refer to a penetration test that can cover absolutely everything or, in other words, does not have a specific or detailed objective, since everything is exploitable and has no further limitations. beyond that which has been agreed with the client(s) for carrying out the pertinent tests. Given the growth of cyberattacks, the filtration and the inappropriate use of the information that exists in the computers due to the lack of security of the network and equipment. At present, security levels in business and/or personal systems have become a highly relevant issue, either due to lack of knowledge and little information that exists about it, or also due to lack of resources, it is left to a side. All this has made ethical hackers unite to create new methodologies and other scripts, in order to avoid or prevent future possible attacks, theft and loss of information. Among the most relevant functions that ethical hackers have is the solution of vulnerabilities, raising awareness among businessmen and other users, improving security processes about the importance of implementing a security system for the protection of sensitive data. The demand for new technologies and innovative procedures to manage what are security and storage systems, promoted the birth of penetration tests, one of the objectives of these tests is the identification of security vulnerabilities, through the use of specific techniques and/or tools. In the digital world in which we live, it is of vital importance to guarantee the security of the information since most organizations have become an easy target for this. It is for this reason that today there are various methodologies that guide many of the auditors to perform tests and apply metrics with the sole purpose of analyzing controls and procedures that verify the aforementioned security. For this, an exploration of all the characteristics of the OSSTMM, OWASP, ISSAF methodologies was carried out using a bibliographic review, in this way finding procedures and standards that guide the effective realization of penetration tests, as a result it is expected that one of the methodologies Proposals comply with the standards and thus help with a contribution to the auditors and make it more complete since in this way they can prioritize the levels of risk of incidents or severity that they have over the objectives of the company to be carried out. the relevant evidence.