Penetration testing is used as a way of detecting flaws in a system so that the correct action can be taken to keep data safe and maintain system functionality. We are going to look at the core penetration testing concepts and how to use it.
What is Penetration Testing?
Penetration testing is a security testing used to determine any insecurities in applications. It is used as a way of finding security risks in a system. If a system is insecure, it may be attacked by hackers who strive to disrupt the system or access the system with authorization. A security risk is usually an error that occurs accidentally while the software is being developed and implemented. This would include design errors, configuration errors, bugs, etc.
Why is Penetration Testing Needed?
Penetration testing is normally used to evaluate the ability of a system to protect its applications, networks, users, and end-users from threats, either internal or external. It is also used to try and protect the security that the system has in place and ensure that access is via authorized users only. Penetration testing is vital because:
- It simulates environments to see how a system may be attacked. This is a white hat attack.
- It finds flaws and vulnerable areas in the system, where attackers may get in. This is also a white hat attack.
- It provides support to stop black hat attackers from getting in.
- It protects the integrity of the data in the system.
- It estimates how far-reaching a potential attack could be.
- It provides evidence of why security investments must be made in terms of IT.
When Should Penetration Testing be Performed?
Penetration testing should be carried out on a regular basis to ensure the system integrity and functionality is maintained. In addition, penetration testing should also be carried out when:
- New attack threats are discovered by the security system.
- A new network infrastructure is added.
- New software is installed.
- The system is updated.
- The physical office is moved to a new location.
- A new end-user policy or program is set up.
How Penetration Testing is Beneficial?
Regular penetration testing provides these benefits:
- Management System enhancements because it provides a detailed analysis of the security threats on the system. As well, it will also detail the level of the vulnerabilities and lists the vulnerabilities in order of threat, from highest to lowest. Because of this, the Management System can be kept secure because the security resources can be allocated as and where needed.
- Avoiding fines. Because penetration testing works to keep the major activities of a company up to date and because it complies with the system of auditing, it protects from fines.
- Financial damage protection. One small breach of a company security system can result in damages costing millions of dollars. Penetration testing can stop this from happening.
- Protection for customers. If even one customer has their information breached it can cause, not just damage to the reputation of the company but financial damage as well. Penetration testing protects companies who have customers and keeps that customer data intact and safe.
The Seven Steps of a Penetration Testing Method
There are seven steps to penetration testing:
- Planning and Preparation
This begins when the objectives and the goals of the penetration test are defined. Both the client and the penetration tester define those goals together so that both sides have the same understanding and the same objectives. The most common objectives are:- Identification of system vulnerabilities and improvement of the technical system security.
- Ensure that IT security is tested and confirmed by a third party.
- To increase security of the personnel and organizational infrastructure.
- Reconnaissance
This includes a preliminary analysis of the information from a system. Most of the time, a tester will not have much in the way of information to work with, other than this preliminary information, and this is usually an IP address or an IP address block. The penetration tester will begin by analyzing what information there is and, if needed, will ask for more information, which could be descriptions of the systems, network plans, etc. this is classed as a passive penetration test and the only objective here is to get a detailed and complete report of the system information. - Discovery
In the discovery step, the tester will use a series of automated tools to scan the assets of the company to discover any vulnerabilities that may exist. These tools usually contain a database that is kept updated with the latest vulnerabilities. However, the tester will also use the following to determine what is there:- Network discovery – looking at additional systems, devices, and servers.
- Host discovery – determines if there are any open ports on the devices.
- Service Interrogation – interrogates ports to see what services are running.
- Analyzing Information and Risks
Now the penetration tester will analyze and assess the information that was gathered in the previous steps. This can be very time consuming because some of these systems are large and the tester could be working with a large infrastructure. Throughout the analysis, the penetration tester will consider the following:- The goals that have been defined for the penetration test.
- The potential security risks on the system.
- The time estimated for the evaluation of potential security vulnerabilities for the active penetration test.
The penetration tester does not have to test all systems; they can choose only those that have got potential flaws.
- Active Intrusion Attempts
This is, without a doubt the most important step and it must be performed carefully because it is all about the extent to which the potential flaws discovered in the early steps can damage the system. This step needs to be performed whenever it is required for potential flaws to be verified. If a system has requirements of high integrity, the potential flaw and risk must be considered very carefully before clean up procedures are conducted. - Final Analysis
This step considers all the previous steps and draws up an evaluation of those flaws that are present, together with the potential risks of them. The penetration tester will, at this time, recommend the action needed to eliminate these flaws and risks. Above all, the penetration tester must show transparency in all the tests and the vulnerabilities that the tests disclosed. - Report Preparation
This is the last step, documenting the test procedures and the analysis of all the risks. These must be listed in order of priority, starting with the critical vulnerabilities and the highest risks. However, while this report is being drawn up, the penetration tester must take the following into account:- The overall summary of the test.
- Full details of all the steps taken, along with the information that was gained.
- Full details of each flaw and the risks associated with it.
- Details of the cleanup recommended and the methods to fixing the flaws.
- Suggestions for the future in terms of the security.
The Difference Between Penetration Testing and Vulnerability Assessments
These terms are often used interchangeably usually because of a misunderstanding. However, they do mean two quite different things, particularly where the objectives of each are concerned.
- Penetration Testing
We already know that a penetration test is used to simulate a real-world attack, being it from an internal threat or an external one. The test is designed to try and break through the security and get into the system, hacking data, or disrupting the system. The penetration tester will find these flaws and recommend how they should be fixed and then secured for the future. - Vulnerability Assessment
A vulnerability assessment, on the other hand, is a technique that involves the discovery of and the measurement or scanning of system vulnerabilities. This is a very comprehensive assessment of the security of information and it can identify weaknesses, providing the correct remediation measures needed to remove the weakness or cut the potential risk right down.
Types of Penetration Testing
There are several types of penetration testing and the one used will depend on the organizational requirements and scope. Let’s look at all the important types of penetration testing:
- Black Box
In this type, the penetration tester does no know anything about the systems that are to be tested. He or she will be more interested in gathering the information needed about the target system or network. For example, in black box testing, the tester will only know that the outcome should be, not how he or she will arrive at that outcome. No programming codes will be examined in black box penetration testing. - White Box
White box penetration testing is incredibly comprehensive as the penetration tester has already been given a good deal of relevant information about the network and/or systems, such as the IP address, the schema, the operating system details, the source code, etc. It is generally considered to be a simulation of an internal attack. It is also known by the names of open box, glass box, structural or clear box testing and it examines the coverage of the code and tests data flow, loop tests, path tests, etc. - Gray Box
In grey box testing, the penetration tester generally provides partial information about the internals of a system or program. This is considered a hack by an external hacker who has gotten unauthorized access to the network documents.
