Penetration testing, also known as pen testing or ethical hacking, is an authorized attack on a computer system, network, or application to identify security vulnerabilities. The test is performed by certified security professionals trained to think like a hacker.
What is the purpose of Penetration Testing?
There are many reasons to have pen testing performed. Some are motivated by security compliance standards such as SOC, NIST, or PCI. Other reasons are due to shareholder, supplier, or partner influence. The goal of a pen test is to identify and document vulnerabilities and weaknesses within the network being tested. The report includes the methods utilized, the impact or severity on the systems, and most importantly, the remediation recommendations that will help direct your team on how to take the corrective measures to secure the discovered issues.
What is the process of Penetration Testing?
Since each organization has specific goals and threat profiles, the scope of a pen testing project may vary from one to another. Usually, the first step is to have an initial meeting to determine and identify key players from your team who will be involved in the pen testing, followed by a comprehensive pre-testing questionnaire to gather specific technical information. A typical pen testing will have the following phases:
-
Discovery Phase - Gather information from a variety of sources to gain familiarity with your network.
-
Threat Identification Phase - Perform a complete analysis of the exposed attack surface identified in the discovery phase and examine software and configuration information that can be leveraged in an attack.
-
Examination Phase - Perform automated vulnerability testing to identify potential threats that exist within your network. Manual testing is also performed using the data discovered during the threat identification phase.
-
Attack Vector Phase - Review the identified threats and vulnerabilities to determine their impact on your overall security posture. The goal is to provide you with a clear understanding of the overall severity associated with the identified findings.
-
Post-Exploitation Phase - Review the obtained access and credentials to identify paths that could identify sensitive data or intellectual property.
-
Post-Assessment Retest - Provide a retest of the original scope within 60 days of the original test report delivery, including the specific critical and high-risk findings identified in the attack scenario phase that led to initial unauthorized access.
What will you get from Penetration Testing?
The results of a Pen Testing will help you:
-
Determine if a hacker can gain access to sensitive data
-
Determine if any systems can be leveraged to launch malicious attacks
-
Reduce the possibility of malware distribution through the network system
-
Determine if a hacker can compromise any administrator accounts allowing access to sensitive data
What’s the difference between a penetration test and a vulnerability scan?
Vulnerability assessments and penetration tests are often misunderstood. A vulnerability scan is like a security guard walking around a building perimeter inspecting doors and windows. It locks to ensure they are stable and functioning properly and do not show apparent damage or weaknesses. A penetration test utilizes the information found in a vulnerability scan but takes the test much further.
During a penetration test, a trained ethical hacker will use these documented vulnerabilities produced by a scan and search for unseen or undocumented vulnerabilities that a real hacker could exploit. They will then verify whether those vulnerabilities found by the scanner or the ones they discovered on their own can be manipulated using hacker techniques.
What are common penetration testing methodologies?
Penetration test standards and methodologies provide an excellent benchmark to the test result. The followings are some of the most respected and widely recognized methods used for a penetration test:
-
OSSTMM - Open-Source Security Testing Methodology Manual: Provides a scientific methodology for network penetration testing and vulnerability assessment to identify vulnerabilities from various potential angles of attack.
-
OWASP - Open Web Application Security Project: Aims to identify vulnerabilities within Web and Mobile applications. Provides over 66 controls to assess in totals to identify potential vulnerabilities within functionalities found in modern applications today.
-
PTES - Penetration Testing methodology and Standards: Highlights the most recommended approach to structure a penetration test. These standards guide testers on various steps of a penetration test, including initial communication, gathering information, and the threat modelling phases.
-
ISSAF - Information System Security Assessment Framework: This Framework is designed to evaluate the network, system, and application controls in Penetration testing methodology. It consists of a three-stage approach and a nine-step evaluation.
-
NIST - National Institute of Science and Technology: A set of standards with quality principles that organizations can use to develop secure information security applications and perform security tests. NIST SP 800-115 provides an overview of the essentials of security testing.
Blair Technology Solutions has a team of certified security professionals who have the skills and expertise to conduct full-scale penetration testing. We follow proven methodologies that ensure a complete and thorough audit each time. Whether the audit is part of corporate policy or required by security compliance, we provide you with the evidence you need to satisfy the most demanding requirements. Contact us to schedule a discovery call!
