7COM1068 Penetration Testing Assignment – PenTest Portfolio, University of Hertfordshire, UK
Learning Outcomes –
1. Successful students will typically have a knowledge and understanding of:
LO1 – The ethical issues relating to penetration testing and how to incorporate them operationally.
LO2 – A deep and systematic application of the tools, methods and procedures (theoretical and methodological) used within the cyber security arena in the context of a penetration test.
LO3 – How to apply advanced and current concepts/issues of computer systems risks, vulnerabilities, threats analysis, and software security in the context of a penetration test.
2. Successful students will typically be able to:
LO4 – Critically analyse and evaluate security techniques used to protect complex heterogeneous environments and apply their findings for offering advice regarding solutions to decision makers.
LO5 – Use initiative for autonomously conducting and managing a penetration test, within a complex and unpredictable environment, demonstrating a systematic approach of creatively applying knowledge in unfamiliar contexts for solving problems.
LO6 – Work in teams (as leader or member) adapting to changing requirements for effectively communicating the results of a penetration test.
Assignment Brief – This is an individual assessment comprised of two parts. Part A will assess your understanding of the statutory and ethical issues surrounding penetration testing and also assess your understanding of the process itself. Part B will assess your ability to conduct a full-scale penetration test. You are expected to demonstrate an insight into the implications of the problem introduced in each task by using clear and concise arguments. You will receive formative feedback as part of the module to demonstrate how to be concise in your written work.
Part A – SOP for PenTesting
It is expected that this task of the portfolio will be the equivalent of 2000 words. You are expected to undertake research and critically compare the published penetration testing methodologies. You are expected to comment on the statutory and ethical considerations of a penetration tester. You are expected to design/develop a Standard Operating Procedure (SOP), including a decision-making tree, to describe how you will undertake part B. In particular: intelligence gathering (target profiling), vulnerability identification and analysis, and target exploitation (including post exploitation). An SOP is defined as a set of step-by-step instructions compiled by an organisation to help workers carry out routine operations.
Part B – Penetration Test
It is expected that this task of the portfolio will be the equivalent of 2000 words. You are expected to conduct a penetration test against a target system that will be provided to you. You are required to present your findings in a factual manner to convince decision makers of a large corporation on business strategies. Do not provide a narrative of your intelligence gathering activities in the main report. You should include this in an appendix. You can use the VPN for undertaking this activity.
Note – The Milestone report and Final Portfolio report must be submitted. You are expected to unify your work into one cohesive portfolio report. The final portfolio report is an academic report and as such the following report structure is expected:
i. Part A
ii. Part B
iii. References: one fused reference list. Do not have a separate reference list for each task of the portfolio,
iv. Appendixes
