NDLI: Penetration testing: a duet

Content Provider	IEEE Xplore Digital Library
Author	Geer, D. Harthorne, J.
Copyright Year	2002
Abstract	Penetration testing is the art of finding an open door. It is not a science as science depends on falsifiable hypotheses. The most penetration testing can hope for is to be the science of insecurity - not the science of security nasmuch as penetration testing can at most prove insecurity by falsifying the hypothesis that any system, network, or application is secure. To be a science of security would require falsifiable hypotheses that any given system, network, or application was insecure, something that could only be done if the number of potential insecurities were known and enumerated such that the penetration tester could thereby falsify (test) a known-to-be-complete list of vulnerabilities claimed to not be present. Because the list of potential insecurities is unknowable and hence unenumerable, no penetration tester can prove security, just as no doctor can prove that you are without occult disease. Putting it as Picasso did, "Art is a lie that shows the truth" and security by penetration testing is a lie in that on a good day can show the truth. These incompleteness and proof-by-demonstration characteristics of penetration testing ensure that it remains an art so long as high rates of technical advance remains brisk and hence enumeration of vulnerabilities an impossibility. Brisk technical advance equals productivity growth and thereby wealth creation, so it is forbidden to long for a day when penetration testing could achieve the status of science.
Sponsorship	Appl. Comput. Security Associates
Starting Page	185
Ending Page	195
File Size	3132899
Page Count	11
File Format	PDF
ISBN	0769518281
ISSN	10639527
DOI	10.1109/CSAC.2002.1176290
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2002-12-09
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Art System testing Security Automation Diseases Productivity Performance evaluation Fires Terminology
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

An Easy-to-Deploy Penetration Testing Platform

A Penetration Testing Method for E-Commerce Authentication System Security

Penetration testing automation assessment method based on rule tree

iDEN Phone System Test: An Automation Approach

Static analysis versus penetration testing: A controlled experiment

Automation of glow-wire test apparatus

Testing inheritance hierarchies in the ClassBench framework

Performance Evaluation and Comparative Analysis of Network Firewalls

Fast model-based penetration testing

Penetration testing: a duet

Similar Documents

An Easy-to-Deploy Penetration Testing Platform

A Penetration Testing Method for E-Commerce Authentication System Security

Penetration testing automation assessment method based on rule tree

iDEN Phone System Test: An Automation Approach

Static analysis versus penetration testing: A controlled experiment

Automation of glow-wire test apparatus

Testing inheritance hierarchies in the ClassBench framework

Performance Evaluation and Comparative Analysis of Network Firewalls

Fast model-based penetration testing

Penetration testing: a duet