Remember, you can't protect what you don't know and that's the main reason why the top two CIS controls have remained the same. Here is an interesting thought from Jeremiah Grossman on Penetration testing / Vulnerability Assessment.

Many ORGs prioritize vuln assessments / pen-tests towards their most ‘critical’ assets. While a seemingly sensible approach, breach data shows it’s very often the obscure or unknown assets that get compromised first — and the adversary pivots. It’s their easiest path to victory.

Did you know - Humans are predictable when it comes to creating passwords and Malicious actors often find that manual guessing of usernames and passwords to be the most effective method

(Scary stats) Rapid7’s pen testers were able to abuse at least one network misconfiguration in 80% of engagements and one in-production vulnerability in 84% of all engagements. In 53% of all engagements, the testers were able to capture at least one credential

Organizations are more interested in securing their own sensitive data – such as internal communications and financial metrics – than that of their customer and employees. (Anyone surprised?)

The report also revealed the top five security priorities of the participating organizations. When it comes to protecting sensitive information, 21% prioritize sensitive internal data, 20% focus on personally identifiable information (PII). Only 14% of organizations ranked protecting authentication credentials as a top-five priority, 7.8% prioritize payment card data and only 6.5% ranked bank account data.

https://www.infosecurity-magazine.com/news/pen-testers-abuse-configuration

Thought for the day - Over 92% of the companies that have performed security tests on are vulnerable. And if companies like Facebook, Paypal, Google etc. are vulnerable – why wouldn’t you be?

More Here:
http://arcticstartup.com/how-to-hack-google-learn-from-it/

8 FREE TOOLS FOR PENTESTING

For those in IT Security, this is not new.
For the rest, this is a small and concise article 

1.  Metasploit
2.  Nessus Vulnerability Scanner
3.  Nmap
4.  Burp Suite
5.  OWASP ZAP
6.  SQLmap
7.  Kali Linux
8.  Jawfish

For More Info:
http://www.csoonline.com/article/2943524/data-protection/8-penetration-testing-tools-that-will-do-the-job.html#tk.rss_dataprotection

DOJO - Free web Application Security penetration testing. Tools + Targets + documentation (what els do you need? free beer, maybe)

What more can you ask for

This removes the possibility of remote attack on the targets, which are insecure by design. The Dojo contains everything needed to get started – tools, targets, and documentation.



Everything You need is here
https://www.mavensecurity.com/web_security_dojo/

Interested in Pen Test - Check out these 10 slide decks

1. Crazy Sexy Hacking - Mark Baggett
2. Hacking in Meatspace - Matt Linton
3. Hacking to Get Caught - Raphael Mudge
4. How To Give the Best Pen Test of Your Life - Ed Skoudis
5. iOS Game Hacking - How I Ruled the Worl^Hd and Built Skills for AWESOME Mobile App Pen Tests - Josh Wright
6. Kicking the Guard Dog of Hades - Attacking Microsoft Kerberos - Tim Medin
7. Penetration Testing is Dead - Katie Moussouris
8. Pentesting Web Frameworks - Justin Searle
9. Secret Pen Testing Techniques, Part 2 - David Kennedy
10. The State of the Veil Framework - Will Schroeder and Chris Truncer
11. Use of Malware by Penetration Testers - Wesley McGrew

Follow this link for additional details:

http://pen-testing.sans.org/blog/pen-testing/2014/12/02/pen-test-hackfest-talks-some-great-reads

Pen Testing Anonymously - Using Tor and Privoxy

Useful when you don't want to be identified when researching bad/Malicious site.



The links below has more information:

http://pen-testing.sans.org/blog/pen-testing/2014/03/16/tor-nonymous-using-tor-for-pen-testing