ICO ITSec PRO

A penetration test is a controlled attack carried out with permission. Everything that makes it useful, and everything that keeps it legal, comes from doing it methodically: a defined scope, a written mandate, a reproducible procedure and a report someone can act on. Improvised hacking is neither a service nor, in most jurisdictions, lawful.

This professional course runs over five instructor led days on site, and it is the practical half of the ITSec pathway. You test at network level, at operating system level and at application level, you work the human factor, and you close with the cryptography a tester meets in the field. The legal and organisational groundwork comes first, because it is what separates a penetration tester from an intruder.

Who this course is for

• IT security specialists moving into offensive testing
• System and network administrators who want to test their own infrastructure properly
• Consultants who will deliver penetration tests as a service
• Security engineers who need to reproduce and verify findings rather than take them on trust
• Holders of the ITSec foundation certificate continuing towards the Professional role

What you will learn

• Scope, mandate and document a penetration test so that it is lawful, repeatable and useful to the client
• Test at network level, from the OSI and TCP/IP model through data link layer and VLAN weaknesses to switching
• Test at operating system level and understand where privilege boundaries actually fail
• Test at application level, the layer where most real findings live
• Work the human factor, from pretexting to phishing, and report it without damaging the people involved
• Apply cryptography in the field: what to attack, what not to bother attacking, and how to recognise the difference

Course outline

Day one, ground rules and the network

• Requirements and the knowledge the course builds on
• Legal and organisational basics of penetration testing, mandate, scope and reporting duties
• Penetration testing at network level

Day two, operating systems

• Penetration testing at operating system level, hands on

Day three, applications

• Penetration testing at application level, hands on

Day four, the human factor

• Attack through the human factor, method, boundaries and reporting

Day five, cryptology and close

• Cryptology in practice
• Exam preparation and sample questions

Prerequisites

None that are formally required. We recommend the ICO ITSec Penetration Testing FND certificate or equivalent knowledge, together with solid networking and operating system experience, because the course works at that level from the first day.

Exam and certification

The course prepares you for the ICO ITSec Penetration Testing PRO examination, awarded by ICO International Certification Organization GmbH. Passing both the foundation and the professional exam leads to the ICO ITSec Penetration Testing Professional role certificate, issued without a further exam.

• 50 multiple choice questions, where one, several or all options may be correct
• 100 minutes, closed book
• Pass mark of 60 percent
• Taken online, at a time and place you choose

The exam is available as an optional add on to the course. Full details are published by the awarding body at ico-cert.org.

What is included

• Five days, 40 hours, of instructor led classroom training in English
• Small groups, never more than 28 participants
• Complete course materials, exercises and sample exam questions
• A prepared lab environment, with hands on testing every day
• Certificate of attendance, with the ICO ITSec Penetration Testing PRO exam as an optional add on