Certification Disciplines

Penetration testing is a method of evaluating the security of a computer system or network by simulating an attack from malicious outsiders and/or malicious to identify attack vectors, vulnerabilities and control weaknesses. It involves the use of a variety of manual techniques supported by automated tools and looks to exploit known vulnerabilities and uses the expertise of the tester to identify specific weaknesses in an organisation’s security arrangements. Penetration testing is often confused with Vulnerability Assessment.

CREST has produced a guide designed to enable organisations to prepare for penetration tests, conduct actual tests in a consistent, competent manner and follow up tests effectively. It provides practical advice on the establishment and management of a penetration testing programme, helping organisations to conduct effective, value-for-money penetration testing as part of a technical security assurance framework. You can download a copy here.

Intelligence-Led Penetration Testing are the assurance of critical functions that are likely to be subject to sophisticated and persistent attack.

CREST Simulated Target Attack and Response (STAR) intelligence-led penetration tests use threat intelligence to deliver these attack simulations to provide assurance that organisations have appropriate countermeasures and responses to detect and prevent cyber-attack. The tests are carried out by experienced penetration testing providers on all types of organisations and are considered to be the most realistic form of assurance service within the sector. This is combined with a review of the company’s ability to recognise and react to cyber security related attacks.

A company must first be accredited to the CREST Penetration Testing discipline before applying for accreditation to STAR Intelligence-Led Penetration Testing. Companies must also have at least one consultant holding a current CREST Certified Infrastructure Tester qualification.

Threat Intelligence is defined as contextualised output of a strategically driven process of collection and analysis of information pertaining to the identities, goals, motivations, tools and tactics of malicious entities intending to harm or undermine a targeted organisation’s operations, ICT systems or the information flowing through them.  Threat Intelligence is used to carry out specialised penetration testing to deliver highly targeted attacks against organisations to simulate sophisticated threat actors.

CREST has produced a guide to Threat Intelligence which provides practical advice on the practice and procurement of cyber threat intelligence services.  It outlines the key concepts and principles that underpin cyber threat intelligence, along with the ways in which organisations use cyber threat intelligence to prevent, detect and respond to potential cyber security incidents.