SECURITY ASSESSMENT

What is a penetration test (Pentest)?

A penetration test is the process of an ethical hacker conducting a simulated attack to test for vulnerabilities and potential attack vectors of a system or network in order to gain access. This process is subsequently outlined in an assessment report that is meant to identify weaknesses in their defensive systems, as well as to what systems and data would potentially be compromised should such an attack occur. Systems can be tested through "black box" testing, which is a simulation of a true adversary attacking the network. In this scenario,  very little is known about the intended target. There is also "gray box" testing, in which basic or limited information is facilitated and "white box" testing, which provides system/background information to provide a more expeditious attack campaign. Several foundational compliance framework require regular penetration testing to be conducted as part of a standard security audit.

​

Generally speaking, there are 5 phases of a penetration test that simulate phases of attack of real world attacker. They are as follows:

1. Reconnaissance - Attackers collect information about networks, systems, targets or personnel (for social engineering) for follow-on exploitation.

2. Scanning - Further, in-depth information is collected about systems which are scanned for vulnerabilities either passively or actively to determine potential attack vectors.

3. Gaining Access - Gathered information is leveraged to the benefit of the attacker to gain access through the delivery of a malicious payload, social engineering, etc.

4. Maintaining Access - Steps are taken to ensure that the attacker can remain persistent within the network and further pivot to more lucrative internal targets.

5. Covering Tracks - Anti-forensic methods such as obfuscation are employed to try to remain hidden from defenders or incident responders.

​

External vs. Internal Penetration Testing - External penetration tests are what springs to mind when most people think of pentesting in general and for the most part, the process is outlined above. Internal penetration testing is a different approach in which some form of access is, by default, granted to the attacker. Studies have shown that internal attacks are typically much more likely than external attacks and can be far more devastating. In the real world, this type of attack could either be carried out by an unassuming or malicious employee or a third party that has been given some level of access. This type of pentest should be employed along with external pentests to gain a full picture of where vulnerabilities lie. To learn more about insider threats, check out our Insider Threat blog, "Beyond the Wire".

 

Web Penetration Testing - Dedicated to your safeguarding your digital footprint, our web application penetration testing services apply our advanced industry expertise to protect your online assets, ensuring your online platforms are secure, efficient, and ahead of the curve.

​

Cloud Penetration Testing - A comprehensive examination of an organization's cloud-based infrastructure, including services, storage, and applications hosted on platforms like AWS, Azure, or GCP. This testing identifies security vulnerabilities and configuration weaknesses, providing insights and recommendations to enhance the overall security posture of the cloud environment.