ECU Penetration Test Guide Ver. 1.0 JASPAR Technical Document: TD-CST-4
- 5 -
Unauthorized copying or reproduction is prohibited by copyright law.
Contents
1. Introduction............................................................................................................................................................. 6
2. Background and purpose of this document ............................................................................................................ 9
2.2.1. Objective of the penetration test ............................................................................................................... 10
2.2.2. Target of the penetration test .................................................................................................................... 11
2.2.3. When to conduct a penetration test .......................................................................................................... 11
2.2.4. Members involved in the penetration test ................................................................................................. 11
3. Processes and activities of penetration testing ...................................................................................................... 13
3.1.1. Making a test plan ................................................................................................................................... 13
3.1.2. Information gathering .............................................................................................................................. 16
3.1.3. Test team building ................................................................................................................................... 16
3.2.1. Agreeing on the test execution plan ......................................................................................................... 17
3.2.2. Preparation for test execution .................................................................................................................. 18
3.3.1. Test execution ......................................................................................................................................... 19
3.4.1. Reporting vulnerabilities and risk levels ................................................................................................... 20
3.4.2. Presenting proposed countermeasures ...................................................................................................... 20
3.4.3. Reporting details of the test execution ...................................................................................................... 21
3.4.4. Agreeing on the final report ..................................................................................................................... 21
3.5.1. Test results assessment ............................................................................................................................ 22
3.5.2. Vulnerability treatment decision .............................................................................................................. 22
3.5.3. Managing the implementation of vulnerability treatment .......................................................................... 23
4. Components of the penetration test ...................................................................................................................... 24
