The best way to detect network risks and other vulnerabilities from dangerous invasion is to test—penetration test, that is. Why bother testing any other way than turning a hacker (an ethical one) loose on your network to search for ways to penetrate and cause harm?
Welcome to the everyday business of pen testing.
What Is Pen Testing?
Penetration testing, or “pen” testing for short, is a process by which vulnerabilities within a network are sought and accurately detected. But it doesn’t stop there.
Pen testing doesn’t just find the vulnerabilities; it exploits them and validates the damage that they could cause. An ethical hacker (often referred to as a “white hat” hacker) has the skill and savvy to find compromises within a network that allow access—both to insiders and outsiders—and potentially wreak costly damage.
Penetration testing can be conducted on hardware, software, or firmware components and may apply physical and technical security controls. It often follows a sequence of a preliminary analysis based on the target system, then a pretest identification of potential vulnerabilities based on previous analyses. Once that is complete, a pretest may help determine the exploitation of the identified vulnerabilities.
In general, all agree to a set of rules before the pen test scenarios are launched. The testing rules include those scenarios anticipated by attacking adversaries. This is all performed in collaboration with known organizational risk and the goals and constraints set by the company who is sponsoring the testing.
Ultimately, pen testing is applied to a company’s network and informs them about susceptibilities. The testers follow up with reports and recommendations to adequately mitigate the discovered risks and vulnerabilities. Pen testing goes beyond the actions of one individual ethically hacking. It also employs complex commercial tools to help them do the job. Ultimately, the whole process adds value and benefits the security of their assets.
How Can a Company Benefit from Pen Testing?
In general, penetration testing is a very effective way to discover, identify, and subsequently prevent the exploitation of network vulnerabilities. Safeguarding against such weaknesses and mitigating the risky pathways open to malicious intent can:
• Avoid financial exploitation and subsequent fiscal damage.
• Avert the possibility of a disruption in service or seamless operation.
• Prevent the confiscation of intellectual property.
• Protect sensitive and private data that could otherwise be sold for financial gain.
• Safeguard against industrial sabotage from insider threats that potentially serve to gain retribution against a company.
• Provide audits and tests for compliance, or lack of compliance, concerning regulatory constraints.
• Serve as analysis after a security incident, where understanding the precise details of the chain of attack and the vectors utilized to gain access helps forensics prevent future threats.
When Do I Enlist the Help of a Consultant or Security Firm?
A company can acquire the tools and software that their IT department can then apply. However, a consultancy or security firm is most often required when the operational complexity of a network or its underlying business operations warrant more thorough and knowledgeable assistance. A security firm that has conducted penetration testing and knows the precursor of true threats and vulnerabilities is an invaluable resource.
Often a company’s enterprise is focused on an IT project’s implementation schedule before it dedicates the proper resources for complete testing. Indeed, the testing may not be addressed thoroughly when a tight schedule pressures the team. However, a dedicated external resource is a fresh set of skills—and tools—to apply to any existing or new enterprise network or project.
In addition, a trusted advisor or consultant may conduct a white box test or a black box test. In a white box test, an attacker is armed with access or intelligence that would be akin to an inside threat and difficult for anyone to attain on their own accord. In contrast, in a black box test, an attacker has limited information that is easily available, such as through preliminary internet research or questioning a company representative. Knowing which type of test is appropriate and how to conduct it is part of the value an external consultant or adviser provides.
What Are Some Types of Assessments Penetration Testing Performs?
Besides tests that explore post-security incidents and others that target regulatory compliance issues, such as payment card standards or health information privacy standards, here are other basic types of assessments that penetration testing may involve:
- Web Application Vulnerability Assessment: The security of web-based applications is addressed by a concerted attempt to exploit application logic that may be faulty or have shortcomings. Corrections and recommendations are included to remove the vulnerabilities.
- External Network Vulnerability Assessment: The focus is on the external network perimeter. This specific security check examines and checks firewalls, routers, network devices, operating systems, and other detection systems.
- Assessments to Internal Network Vulnerabilities: Internal networks and accompanying systems are thoroughly checked. Specifically, it examines the ability of an unwanted external visitor to wander into, and access, the internal network.
- Wireless Assessment: The vulnerabilities in wireless networks are checked. Often called “war walking” or “war dialing,” this process uncovers the access points and their locations that are available to unwanted sources. It also enables the assessment to further penetrate and exploit the discovered access.
- War Dialing Assessment: Vulnerable modems are identified by dialing a prescribed set of targeted numbers with the intent to access a modem that will allow entry. If a modem is located, the vulnerability will be further exploited to see if the network offers an opportunity to penetrate further and cause subsequent damage and compromise.
What Are Some of the Common Certifications for Penetration Testing?
- Certified Ethical Hacker (CEH): Governed by The International Council of E-Commerce Consultants (EC-Council), this certification encompasses the important e-business and information security skills and serves as the guiding set of standards for professional ethical hackers.
- Licensed Penetration Tester (LPT) Master: Also governed by the EC-Council, the LPT is a comprehensive certification that extends beyond other preliminary certifications. It is the highest bar attainable by a penetration tester. Candidates conduct a full black-box penetration test of a network provided by the certifying authority and perform a follow-on vulnerability exploitation.
- Global Information Assurance Certification Penetration Tester (GPEN): Governed by The Global Information Assurance Certification (GIAC), this certification is issued upon demonstration of expertise in assessing targeted networks for security vulnerabilities.
- GIAC Exploit Researcher and Advanced Penetration Tester (GXPN): This certification is a notch above the GPEN and tests the professional knowledge, skills, and abilities to carry out advanced penetration tests.
- Offensive Security Certified Professional (OSCP): This certification is very specific and teaches methodologies to penetrate Kali Linux distribution. To earn it, a candidate participates 100 percent hands-on and must successfully attack live machines.
Pen testing is a skill that is pedigreed with certification, training, know-how, and experience. It requires multiple skills as the assessment may take different forms and applications, depending on the needs of an enterprise. A consulting firm or agency that has the proper certification and experience can meet the company’s specific needs and provide the proper advice. In this way, penetration testing stands as the best way to detect network risks and other vulnerabilities from dangerous invasion.
Are you interested in learning more about this topic? If so, you'll definitely want to take part of the action at the InfoSec World Conference & Expo in Orlando, Florida.
