Procedimento operacional padrão (POP) para execução de Pentest

Abstract

The increasing need for digital solutions in all business areas has driven the demand for secure, robust, and always-available IT infrastructures. To achieve this, it is necessary for companies and institutions to implement cybersecurity policies and procedures, such as conducting risk assessments, implementing secure network architectures, deploying identity and access management tools, and performing periodic penetration tests (pentest). In this context, the proposed work aims to operate in one of the key areas of cybersecurity, specifically in the field of penetration testing. The focus is to test computational environments (networks, web applications, servers, etc.) to verify their security and subsequently report the findings through a technical report. However, as automated tools are still underutilized and considered unreliable in this field, professional analysis and interpretation are always required for each action, as the tested environments and results are often unpredictable. Nevertheless, there are still no well-defined procedures in the literature for the tester to conduct the procedure. Therefore, the objective of this work is to describe a Standard Operational Procedure (SOP) for testing and thus provide the community (professionals and students) with a step by step methodology to perform and analyze the tests, thereby achieving agility and confidence, even though pentesting depends on the tester’s interpretation.