Penetration testing assesses and exploits vulnerabilities in an application or infrastructure by circumventing or defeating security features of system components through rigorous manual testing.
Typically, vulnerabilities occur due to insecure code, misconfiguration, poorly designed architecture, or disclosure of sensitive information.
A penetration test produces an actionable report that details each vulnerability or chain of vulnerabilities exploited to gain access to a target, the steps taken to exploit them, how to fix them, and additional recommendations. Each discovered vulnerability is given a risk rating, which can be used to prioritize remediation tasks.
Benefits of Penetration Testing
Penetration testing uncovers vulnerabilities that would not have been discovered otherwise, such as a vulnerability scan. False positives are filtered out due to the manual human analysis. It also demonstrates what kind of access and data can be obtained by exploiting vulnerabilities in the same way that a real-world attacker would. Given each vulnerability used to gain access, this effectively demonstrates the real risk of successful exploitation.
The organization’s cyber defenses will also be put to the test during penetration testing by evaluating web application firewalls (WAF), intrusion prevention systems (IPS), and intrusion detection systems (IDS). These systems should generate alerts and trigger internal procedures during a penetration test, resulting in a response from the organization’s security operations teams.
Who needs Penetration Testing?
All organizations should perform penetration testing if they have an online presence, a web or mobile application, or a connected digital infrastructure. Any connected or non-connected technology should be subjected to a penetration test after implementing or developing a new web or mobile application, network infrastructure, or hardened kiosk client before going live.
New vulnerabilities are discovered over time and must be validated to determine how they can be exploited or chained with other vulnerabilities to gain access to a target.
Therefore, it is recommended to perform a penetration test periodically and after changes are made. Penetration testing is also required for organizations that must comply with compliance standards such as PCI-DSS v.3.0 requirement 11.3, which requires penetration testing on an annual basis or after any significant change.
Why is it important?
The following are some of the reasons why organizations should conduct penetration testing:
- To ensure that current controls, as well as how they are implemented and configured, are effective.
- To create controls to address flaws in the infrastructure, application, or process that have been discovered (Hardware, Software, and People.)
- To determine how effective an application’s input validation controls are. Wherever user input is entered, it is subjected to rigorous fuzz testing to ensure that only sanitized data is accepted.
- To reduce the time it takes for security to respond. A penetration test can reveal how different teams react to an intrusion and help organizations improve their internal incident response processes and procedures.
Types of Penetration Tests?
Web Application Penetration Test: These tests look for flaws in web application components such as frameworks, server software, APIs, forms, and anywhere else where user input is accepted.
Mobile Application Penetration Test: This tries to exploit how a mobile application accepts user input, how securely it is stored on the phone, how securely data is transmitted across the internet and any web service vulnerabilities in the API.
External Infrastructure Test: Checks for ports open on all externally facing ranges; attempts are made to fingerprint and exploit services discovered and bypass authentication mechanisms and brute force VPN gateways.
Internal Infrastructure Penetration Test: This will attempt to obtain full system administrator privileges from within the internal network. Checks are made to see if there are any vulnerable services or software, and exploits are used to gain access. Network traffic is normally sniffed to capture credentials and other sensitive traffic in transit while ARP poisoning is performed.
Wireless Penetration Testing: At its most basic level, this entails attempting to decrypt WEP and WPA encryption to gain access. Other attacks are attempted, such as Man in the Middle (MitM), in which wireless clients are tricked into connecting to a dummy access point.
Endpoint / Kiosk PC Penetration Test: These penetration tests attempt to break out of a kiosk PC or other locked-down device and gain elevated privileges or access to sensitive data that should otherwise not be accessible.
