What is Penetration Test?
How would your organization be affected if your company files were stolen, held ransom or even made public?
Are you confident that your network cannot be breached?
How can you insulate your network from a cyber attack?
Cybersecurity is a growing concern for businesses today. As more information is being stored virtually, the greater is the need for business cybersecurity to protect confidential data.
A single network breach can lead to data loss, loss of network uptime and long-term financial damages to an organization. Attackers are becoming increasingly successful in penetrating vulnerable systems, leaving organizations with the growing challenge of protect their network.
Protecting your network against cybersecurity threats requires a defense-in-depth approach to cybersecurity, and frequent penetration testing. A penetration test is designed to identify specific security vulnerabilities and help organizations better secure their data. A component of security auditing, penetration testing uncovers the areas of security risks that can impact an organization, its functionality and data.
– Daniel Stockman, President / i-Tech Support
Assessments are designed to expose external vulnerabilities and make specific recommendations on how to better secure them. A penetration test is a specialized network assessment designed to identify security weaknesses which can be exploited. Penetration testing goes beyond simple checks to test security posture and identify vulnerabilities that attackers can use to access data. System components, processes and custom software must be tested frequently to ensure security controls remain intact against environment changes.
Penetration testing (or Pen Testing) is commonly known as “Legal Hacking”, as it involves hiring a cybersecurity professional to penetrate the network in a controlled environment. A goal, such retrieval of credit cards, client information, passwords, or other important data, is often determined at the start of the test. The pen tester then makes a series of attempts to obtain the information through electronic, physical and social means, as a hacker would in a cyber attack. If the test is successful (i.e. the pen tester gains access to the data), the points of entry identified can then be secured.
Penetration testing provides detailed information on exploitable security threats so they can be prioritized for remediation, have relevant security patches applied and allocate necessary resources.
– Avery Rozar, Cybersecurity Practice Leader / i-Tech Support
Penetration Testing is often mistaken for vulnerability scanning or port scanning. Some technology providers do not explain the difference between these tests to clients, and may even market them as the same assessment. The main difference between these tests is depth. Penetration testing is a multi-step process that goes deeper than vulnerability scanning to address specific goals and security guidelines. A vulnerability scan is a simple scan designed to assess computers, computer systems, networks or applications for potential vulnerabilities. Port scanning involves searching a network to see which TCP or UDP ports are open to connection. Both vulnerability scans and port scans report the areas where potential attacks can occur, which is only a fraction of penetration testing.
What is involved in a professional penetration test?
A penetration test involves four (4) specific stages. It is important to discuss the scope of work with your cybersecurity firm to ensure you are getting a professional penetration test that includes all these stages. Professional cybersecurity firms like i-Tech Support include each stage in their pen test and also deliver recommendations to fix cybersecurity issues uncovered by the test.
Here are the four stages of a professional penetration test:
- Stage 1: Information Gathering: Here, the pen tester uses open source intelligence gathering to gather information about the company, its executives, investors, employees and 3rd party organizations. They may leverage search engines, social media, the company website and even onsite visits as part of the process.
- Stage 2: Threat Modeling: Next, the pen tester identifies primary and secondary assets. Here the tester focuses on two key elements – assets and threats. Each is further broken down into business assets, business processes, the threat communities and their capabilities.
- Stage 3: Vulnerability Analysis: This process involves Active/Passive Testing, Validation, and Research. Active Testing directly involves interaction with the components being tested, this could be as low a TCP stack on a network device, or higher up the OSI model directly on the web application. Passive testing includes metadata analysis from files directly lifted from the corporate website, or traffic monitoring (sniffing) for offline analysis. The final part of vulnerability analysis phase is validation. Here, the tester correlates data from multiple tools, research results and from sandbox testing to gauge the network vulnerability.
- Stage 4: Exploitation: In this stage, the pen tester attempts to aggressively penetrate the network as a cyber attacker would. Fuzzing, brute force attacks, buffer overflows, cross site scripting and social engineering are a few methods typically used to gain access to the client network and data. Exploitation uses software on the weakest points of a network to take control. Social engineering is another exploitation strategy used, which involves baiting employees into helping the tester access the network though fishing emails, leaving USBs around the office, or even using an unmanned computer.
Once access into the network is gained, access to other computers becomes effortless. The tester pushes further in to take more control over the network. Under full control, the tester can then retrieve sensitive files, read passwords, take screenshots, turn on webcams and install malware.
When the penetration test is done, the tester backs out any deployed agents, removes all back doors and shuts down any access created from the test.
Can a pen test protect a business from a cyber attack?
Penetration testing allows vulnerabilities to be uncovered by a professional rather than an intruder. The test shows how a hacker can penetrate a company’s network and how much of their data can be accessed. Owners can learn a lot about weaknesses within their network in an environment they control, rather than having those vulnerabilities exploited by the attacker without warning. In this way, a professional penetration test serves to potentially thwart a cyber attack.
What are some of the most frequent questions asked about penetration testing?
We asked the cybersecurity experts at i-Tech Support to answer some of the most common questions business owners ask about penetration testing:
Why should a business conduct an external security penetration test?
The main reason is to find vulnerabilities and fix them before an attacker does. Many businesses today have sophisticated security systems that can respond to threats. The Penetration Test Assessment provides these businesses with the opportunity to evaluate their threat response systems.
How long do penetration test assessments last?
These engagements should not be less than one week. Most pen tests last 2-4 weeks.
Will my business be affected during a penetration test?
No. Ideally a penetration test is performed while business is operating under normal conditions.
How often should a business test their external security perimeter?
Maintaining a secure infrastructure requires constant vigilance. Security vulnerabilities surface frequently and can potentially occur at any time. Businesses should conduct regular testing in order to maintain a secure environment for all stakeholders at least once per year and also after each major network change.
Is there a risk of a penetration test compromising the client’s data?
Not if performed by a professional. A cybersecurity firm, such as i-Tech Support, understands how to conduct an external test without causing damage to the overall information infrastructure. There are strict policies which should be in place to ensure testing is conducted in a safe manner and according to quality standards.
Does the pen tester make recommendations on how to secure the environment after the test?
A penetration test is not complete unless a final report is given with a list of vulnerabilities and recommendations for better securing the environment. Cybersecurity firms like i-Tech Support include a cybersecurity strategy with each penetration test.
Can the pen test be customized to specific cybersecurity concerns?
Yes. All penetration tests are not the same. An organization can delegate guidelines or rules to a test, adding limits based on their specific cybersecurity concerns.
Do you have a question about cybersecurity or penetration testing within your network?
i-Tech offers professional Penetration Testing and Managed IT Services for business
i-Tech Support is a Total Technology Support firm dedicated to Managed IT Services, Advanced Technology, Cloud Services and Information Security Business Services.
Call i-Tech Support: 407-265-2000 info@i-techsupport.com
