What is Penetration Testing?

Penetration Testing or “pen test” is an emulation of what a bad actor could do when targeting an organization. Its goal is to find vulnerabilities affecting assets and find out how to leverage those to breach perimeters, obtain sensitive data, take over hosts, or cause damage.

The depth of testing can vary, from resilience against low skill “script kiddies” to professional nation-state level attackers. The scope can be adjusted to meet the organization’s needs.

Pen tests are performed by specialty security engineers whose focus is essentially breaking and entering with the blessing of the customer in order to improve overall security posture. The scope of testing depends on the type of engagement and goals. The tests can be conducted using a range of prior knowledge, below are the three terms typically used.

• “White box” – The pen test engineers have access to code, hosts, or other assets
• “Black box” – The pen test engineers have no previous knowledge of the organization’s infrastructure
• “Grey box” – The pen test engineers have some prior knowledge

Cybersecurity is a war comprised of battles with elements of offense and defense. In a penetration test, team names are given to the attacking team (Red Team) and the defending team (Blue Team.) The Blue Team could be made up IT staff or a SOC.

Red Teaming is a full scope assessment that best mimics what a real attack could do. This is essentially the closest thing to actually being targeted by bad actors. All attacks are allowed, including the pen tester arriving on premises unannounced to employ physical or social engineering tactics.

While this is the closest and most accurate type of testing, it can also be the most expensive, requiring substantially more time and money than other efforts. It is geared toward testing a more mature security program that has some baseline of self-evaluation. It is designed to be campaign driven with goals.

Purple Teaming is an arrangement where the Red Team is in communication with the Blue Team, usually a SOC. As tests are performed, feedback among the groups can help determine blind spots, security assumptions, etc. This is a more collaborative exercise with the goal of improving the Blue Team.

Vulnerability assessments are quick engagements based on scanning remote hosts for known vulnerabilities. It’s a less thorough method that can often miss major vulnerabilities that can’t be revealed by an external scan.

It’s important to examine scan results after the fact and perform a manual validation of vulnerability discoveries to rule out false positives. Best practice is to perform the scan, validate, then compile a more accurate report. The level of effort needed depends on the number of hosts being scanned.

There are many different types of assessments that can be made during a penetration test. They can vary based on the organization being tested and the types of assets and services they utilize. While external and internal pen tests get much of the focus, a holistic approach that uses all applicable assessments is recommended to identify blind spots.

Here is a list of assessments:

While it can vary depending on the engagements or the types of assessments requested, in general most will follow this common setup/sequence:

• Setting ground rules and understanding customer needs: Goals should be explicitly communicated by the customer, often with the help of the Pen Test team asking questions or making suggestions not previously considered. Requirements, expectations, and parameters or limitations of the testing should be set at this stage.
• OSINT: Open Source Intelligence Gathering
• Enumeration: Information gathering and enumeration of assets being tested
• Threat modelling: Build an attack plan and map different attack paths
• Exploitation: Execution of the previously determined attack paths to gain a foothold
• Post-exploitation: Once a foothold is gained, data can be gathered, accounts can be compromised, and the business impact of exploited vulnerabilities truly understood.
• Understanding long term security strategy: Once testing is complete, an analysis is made to determine the root of problems found. Are they related to patch management? Active Directory misconfiguration? What are the long-term security strategies in light of new intel?
• Cleanup: Removal of any remaining artifacts of the test and return systems to normal. This shouldn’t be the responsibility of the customer.
• Reporting: Once testing and analysis is complete, a report outlining the results of the penetration test is provided to the customer including insights and action items.
• Remediation validation test: If the customer remediates any issues discovered during pen testing, a follow-up validation can be performed to validate those measures.