ELI5: what is penetration testing?
When you hear the word ‘hackers’, you might imagine a darkened room full of highly skilled tech criminals, typing away as they hack unscrupulously into your software.
But not all hackers are this Hollywood depiction of a malign computer genius. There are also ethical hackers. And one of the things they do is called penetration testing.
So, what is penetration testing? Here’s an ELI5 overview.
What is penetration testing?
Penetration testing, also known as pen testing and ethical hacking, is a method of testing your cybersecurity by conducting an authorised cyber-attack. It comes in a variety of types:
- Blind testing
In a blind test, the only information the ethical hacker is given is the name of the target. This means that their attack will closely match the kind of thing you might see in a real attack.
- Double-blind testing
In a double-blind penetration test, along with the hacker not receiving much information, the security/IT team don’t know that a simulated attack is happening. This means that they won’t have a chance to amend their defence before the test, and may also showcase their ability to detect attacks.
- Internal testing
An internal penetration test is where the ethical hacker operates from behind your firewall. The idea is to simulate an attack from a malicious inside source. For instance, a rogue employee or (more often) a compromised account.
- External testing
An external penetration test focuses the attack on accessing your external assets. For example, your website or web application and email addresses.
In short, penetration testing is a simulated attack on your system, programs, or network.
Why carry out penetration testing?
So, what is penetration testing for?
The benefit of a penetration test is the insight you gain. You get an idea of the weak spots in your systems. Specifically, the weak spots that outside agents might find and exploit to gain unauthorised access.
In turn, you can make changes and patch those weaknesses before your system is pitted against a real malicious attack.
Ethical hackers
The ethical hacker that will put your systems through a pen test should, in general, be a third party. That is, someone outside of your organisation or someone without prior knowledge of how your system is secured. (As the point of a penetration test is to simulate an attack from an outside source.)
Simply, the test won’t be as meaningful if the hacker knows how to access the system from the offset.
How do you conduct a pen test?
Another way of looking at the ‘what is penetration testing’ question is to look at what carrying one out entails. There are five key stages to a penetration test.
Step one: reconnaissance
First, the ethical hacker will gather information about their target. This will include the goal of the test, and any intelligence about how the target works.
Step two: scanning
Next, the attacker will use tech tools to scan for any more vulnerabilities and see how the target responds to different attempts at intrusion.
Step three: gaining access
From there, the ethical hacker will launch their attack on the target system, looking for vulnerabilities and trying to exploit them. The aim is understanding the type and scale of damage they could cause if they were a malicious attacker.
Step four: maintaining access
The fourth step is all about seeing how long an attacker could seemingly stay in the system undetected. The idea here is that the ethical hacker is gaining an understanding of the target’s vulnerability to advanced persistent threats.
Step five: covering tracks and analysis
The final step of the penetration test is for the hacker to remove any trace of their visit into the system. Then they can report their analysis to the system owner.
What is penetration testing?
Penetration testing is an important process for ensuring the cybersecurity of your systems and software. With it, you not only understand the vulnerabilities of a system but the damage they could potentially lead to.
Useful links
Shattering the myth of the lone tech genius
Privilege creep: do you really need access? A message from your IT team
