Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

A  |  B  |  C  |  D  |  E  |  F  |  G  |  H  |  I  |  J  |  K  |  L  |  M  |  N  |  O  |  P  |  Q  |  R  |  S  |  T  |  U  |  V  |  W  |  X  |  Y  |  Z

penetration testing

Definitions:

  A method of testing where testers target individual binary components or the application as a whole to determine whether intra or intercomponent vulnerabilities can be exploited to compromise the application, its data, or its environment resources.
Sources:
NIST SP 800-95 under Penetration Testing from DHS Security in the Software Lifecycle

  A test methodology in which assessors, typically working under specific constraints, attempt to circumvent or defeat the security features of a system.
Sources:
NIST SP 800-12 Rev. 1 under Penetration Testing
NIST SP 800-53 Rev. 5
NIST SP 800-53A Rev. 5

  A test methodology in which assessors, typically working under specific constraints, attempt to circumvent or defeat the security features of an information system.
Sources:
CNSSI 4009-2015

  A test methodology in which assessors, using all available documentation (e.g., system design, source code, manuals) and working under specific constraints, attempt to circumvent the security features of an information system.
Sources:
NIST SP 800-137 under Penetration Testing

  Security testing in which evaluators mimic real-world attacks in an attempt to identify ways to circumvent the security features of an application, system, or network. Penetration testing often involves issuing real attacks on real systems and data, using the same tools and techniques used by actual attackers. Most penetration tests involve looking for combinations of vulnerabilities on a single system or multiple systems that can be used to gain more access than could be achieved through a single vulnerability.
Sources:
NIST SP 800-115 under Penetration Testing

  Testing that verifies the extent to which a system, device or process resists active attempts to compromise its security.
Sources:
NIST SP 800-152 under Penetration testing

  Testing used in vulnerability analysis for vulnerability assessment, trying to reveal vulnerabilities of the system based on the information about the system gathered during the relevant evaluation activities.
Sources:
NIST SP 800-160v1r1 from ISO/IEC 19989-3:2020