2 cissp ® Official Study Guide Eighth Edition

Obtaining Permission for Penetration Testing 
Penetration testing should only be performed after careful consideration and approval of 
senior management. Many security professionals insist on getting this approval in writing 
with the risks spelled out. Performing unapproved security testing could cause productivity 
losses and trigger emergency response teams. 
Malicious employees intent on violating the security of an IT environment can be pun-
ished based on existing laws. Similarly, if internal employees perform informal unauthor-
ized tests against a system without authorization, an organization may view their actions as 
an illegal attack rather than as a penetration test. These employees will very likely lose their 
jobs and may even face legal consequences.
Penetration-Testing Techniques 
It is common for organizations to hire external consultants to perform penetration testing. 
The organization can control what information they give to these testers, and the level of 
knowledge they are given identifi es the type of tests they conduct. 
Chapter 20, “Software Development Security,” covers white-box testing, 
black-box testing, and gray-box testing in the context of software testing. 
These same terms are often associated with penetration testing and mean 
the same thing.
Black-Box Testing by Zero-Knowledge Team
A
zero-knowledge team
knows nothing 
about the target site except for publicly available information, such as a domain name and 
company address. It’s as if they are looking at the target as a black box and have no idea 
what is within the box until they start probing. An attack by a zero-knowledge team closely 
resembles a real external attack because all information about the environment must be 
obtained from scratch. 

---

Implementing Detective and Preventive Measures