NIST SP 800-115 Explained: Assessment Techniques for PenTest+

NIST Special Publication 800-115 is the Technical Guide to Information Security Testing and Assessment. It carries weight because it is a recognised government standard, so referencing it satisfies auditors in a way a commercial methodology may not.

For the comparison of methodologies generally, see the companion article linked at the end. This one covers 800-115's own structure.

The four phases

Planning. Treated as a project management activity. Gather rules of engagement, define scope and objectives, obtain management approval, and establish logistics and communications. Nothing technical happens here, and the document is explicit that assessments fail more often for lack of planning than for lack of technical skill.

Discovery. Two parts. Information gathering — network discovery, port and service identification, OS fingerprinting — and then vulnerability analysis, comparing what was found against known vulnerabilities.

Attack. Verifying vulnerabilities by attempting to exploit them. Importantly, this phase loops back into discovery: gaining access reveals new systems and information, which feeds another round of discovery, which may lead to further attack.

Reporting. Runs in parallel throughout rather than only at the end, documenting findings, risk ratings and mitigation recommendations as they arise.

The attack-to-discovery feedback loop is the structural feature worth remembering, because it reflects how assessments actually proceed and distinguishes 800-115 from purely linear models.

The three categories of technique

This taxonomy is the most useful part of the document and a likely exam target.

Review techniques. Passive examination of systems, applications, networks, policies and procedures. Documentation review, log review, ruleset review, system configuration review, network sniffing and file integrity checking.

They carry minimal risk of disruption because nothing is actively probed, and they frequently find issues that scanning never will — a firewall rule that is permissive but generates no vulnerability finding, or a policy that is not being followed.

Target identification and analysis techniques. Actively identifying systems, ports, services and vulnerabilities. Network discovery, port scanning, service identification, vulnerability scanning and wireless scanning.

These interact with targets, so they can affect availability and will appear in logs.

Target vulnerability validation techniques. Confirming that identified vulnerabilities actually exist and are exploitable. Password cracking, penetration testing, social engineering and application security testing.

Highest risk, highest confidence. A scanner reports a possible vulnerability; validation proves it.

The progression is the point: review is passive and safe, identification is active and moderate risk, validation is intrusive and proves the finding. An assessment usually applies all three, and scoping decides how far into validation it goes.

Why validation matters

The document is clear that scan results are hypotheses. Scanners produce false positives from version banners that do not reflect backported patches, and false negatives where a vulnerability is not detectable remotely.

Validation resolves both, and it changes how a finding is received. "The scanner reports this may be vulnerable" invites argument; "we exploited this and retrieved the customer database" does not.

Handling the results

800-115 emphasises the parts that are not testing, and they are worth knowing because they appear in exam questions about professional conduct.

Data handling. Assessment data — credentials, vulnerability details, captured traffic — is highly sensitive and must be protected in transit, in storage and in destruction. A penetration test report is a roadmap for attacking the organisation.

Root cause analysis. Findings should be analysed for underlying causes rather than listed individually. Forty missing patches across the estate is one finding about patch management, not forty findings.

Mitigation recommendations that are actionable and prioritised by risk rather than by scanner severity.

Remediation verification — retesting to confirm fixes worked, which is a phase organisations routinely skip.

Where it fits

Use 800-115 where a recognised standard is required for compliance or for a government-related engagement. Use PTES for a richer commercial engagement structure, OWASP guides for application test detail, and OSSTMM where physical and human channels are in scope. They are not mutually exclusive, and many engagements cite 800-115 while working to PTES phases.

What to remember

Four phases: planning, discovery, attack, reporting — with attack feeding back into discovery and reporting running throughout. Three technique categories: review (passive, low risk), target identification and analysis (active scanning), and target vulnerability validation (exploitation, highest confidence). Scan findings are hypotheses until validated. Assessment data is itself highly sensitive.

Related reading: Penetration testing methodologies · SOW and rules of engagement · CVSS