This is the first in a series of posts looking at the current state of pen testing as I see it and presenting some ideas for the future. In this post I will apply a framework to understanding the process of pen testing.
In the next post here I discuss some of the problems I see in pen testing.
The pentesting process is a form of expert behaviour similar to intelligence analysis where there has been a lot of work understanding the key components of expert performance; this is often broken down into a process flow as follows:
Gather Information → Represent in Expert Schema → Develop Insight → Define Product or Action