Penetration Testing: Beating Hackers at Their Own Game

What is the best way to figure out how a hacker might access your network?

Act like one.

All it takes is one weak spot in your network defenses for a hacker to gain access and wreak havoc on your operations. 

Considered ethical hacking, penetration testing puts your network and its security measures to the test with no damaging consequences to your organization.

 

What is a Penetration Test?

Penetration testing puts a professional assessor in the shoes of an external or internal bad actor. In this role, the assessor attempts to gain access to privileged and sensitive information on a network or its devices. They use a variety of penetration testing tools to analyze your network, security protocols, and entry points.

There are six steps to the penetration testing process:

 

1. Pre-engagement

To start the process, an organization and assessor determine the scope and rules of engagement (ROE) for the test. For instance, an organization may only allow access to specific parts of a network for testing or set certain times for testing activities. Depending on the ROE, the assessor is given some basic access to the environment. 

 

2.Intelligence Gathering 

Like a hacker carefully selecting their next target, the assessor and their team perform reconnaissance against the network being tested and its security protocols. They turn to a variety of methods, such as:

• Open Source Intelligence (OSINT) gathering
• Host discovery
• Service discovery

 

3. Threat Modeling 

Once the information about your network and security protocols is on the table, analysis begins. The assessor maps out potential attack paths and works with you to prioritize the simulations.

 

4. Vulnerability Analysis & Exploitation

This is where the rubber hits the road. With a plan of attack, attempts to compromise the network commence. Both automated and manual detection methods are used to exploit the system using penetration points.

 

 

5. Post Exploitation

If the assessor gains enough of a foothold in your system, they will attempt to continue to travel as far into the system as possible. They repeat this step for every perceived crack and attack vector your system may face until they exhaust all possibilities.

 

6. Reporting

With a simulated attack complete, an assessor will prepare a detailed report of their actions and document findings on vulnerabilities. The assessor will also provide actionable steps for remediation. 

 

Preparing for a Penetration Test

While there is no warning in the real world that an adversary has targeted your network for an attack, successful penetration testing does require some legwork ahead of time. 

When planning for a penetration test: 

• Schedule the test after making any significant changes to your network.
• Remember: even though they are acting like one, an assessor is not your enemy. They are there to help you shore up any areas of weakness in your network. An outside third party brings a fresh perspective.
• Encourage members of your IT department or staff to voice all their concerns. Before the test is the time for them to note any possible weak spots in the network they feel need attention, such as:
  • Legacy servers
  • Login permissions
  • Remote access setup
  • Applications 
• Do not lie or hide things from the assessor. They can only act on the information you provide them with. One factor, once learned, may change their entire strategy towards the testing methods previously agreed upon. 

 

What to Look for in a Penetration Tester 

There are no formal requirements for who can perform penetration testing any more than there are requirements to be a malicious hacker.

When seeking a company to perform these tests, a good indicator of their skill and experience is to ask for a sample penetration test report. An excellent report will clearly and succinctly identify:

• Methods of the assessment
• Identified weaknesses 
• Easy-to-understand summaries
• Actionable remediation recommendations

 

As with hiring any third-party service provider, asking for references is also a must. 

 

Penetration Testing vs. Vulnerability Assessments

Often confused for one another, penetration tests and vulnerability assessments are not the same things. 

Vulnerability scanning is part of the penetration testing process and provides a loose gauge of the potential weaknesses in your network security. They are a good starting point and provide data needed to move forward with a penetration test.  

During a vulnerability scan, an assessor will use several tools to search your network and protocols for many machine-measurable items, which can include:

• Outdated software
• Lack of two-factor authentication
• No minimum password length

 

Assessors take these findings and validate them. They remove any false positives and report the rest. Because the scanning tools are tools, they do not think like humans. 

Penetration testing brings human intelligence to balance the vulnerability assessment findings.

 

Penetration Testing for Optimal Network Security 

Consider your home. The last thing anyone wants is to install a security system that does not entirely work. That is like literally leaving the door open to intruders. 

To an extent, penetration testing is no different than making sure your home security measures function as they are supposed to. Comprehensive penetration testing helps your organization identify network weaknesses and reinforce any potential entry points to keep those with less than good intentions out. 

Put Your Network Security to the Test

Speak with a member of our team about our penetration testing services.