What is Penetration Testing?
A Penetration Test commonly consists of assessing; the confidentiality, integrity and availability of an information system, widely known as the CIA triad.
There are numerous penetration testing approaches. This can include black-box testing, white-box testing and grey-box testing which all, in turn, provide remediation advice. However, the three types of testing define different approaches the consultant takes during an assessment and all have different benefits and disadvantages.
Furthermore, there are endless options for assessment types adapted to assess different types of systems. Assessments range from infrastructure assessments such as; external or internal tests to web application reviews. Web Application Assessments may also vary in the way they are carried out; authenticated or unauthenticated. In addition to several other different security assessments including but not limited to; Firewall Reviews, Build reviews, Cloud Assessments and many more. As a whole, these assessments and reviews provide an overview of possible attack vectors a threat actor may take on a given estate.
The common process for many assesses is to carry out non-disruptive attacks against given systems to identify vulnerabilities and thus, be able to provide remediation advice to keep the system more secure. On the other hand, this may involve reviewing configuration files and advising on the best security standards that can be implemented to mitigate potential threat vectors.
It is commonly found that penetration testing uses multiple testing methodologies. This is so the assessments can be carried out in many different environments and across different platforms.
How does a Penetration Test Differ From Vulnerability Testing?
Vulnerability assessments rely on automated tools to quickly gather as many known vulnerabilities as possible in a given time frame.
While on the other hand, penetration testing goes further by adopting manual testing and therefore, it can assess logical flaws where an automated scan may not otherwise be able to identify. These may be issues in the implementation of an application that may allow a threat actor to manipulate legitimate functionality for a malicious purpose.
Additionally, vulnerability scans may not be the best representation of a given system as they are prone to false-positive results and rely on known vulnerabilities. In a penetration test, these tools can be used to provide a small overview of the estate and make up a fraction of a penetration test which can be followed by manual testing to confirm the results.
How Long Does a Penetration Test Take?
Assessment length can vary depending on the size of scope however, as it is important to be able to assess the given applications/devices to the best standard possible and provide the most accurate information, it is common to follow a standard when assigning assessments a day count.
Often during this stage, it is important to identify anything that may slow down the assessment. Again this is so to give the application/device being assessed the best standard without time constraints.
Why do you need a Penetration Test?
It is key to assess the integrity of applications and devices due to the impact a security breach may have. Several areas are impacted during such devastation including but not limited to; financial losses, legal liability, business continuity problems and loss of productivity.
Therefore there are many reasons you may need a penetration assessment.
Top 5 reasons to get a Penetration Test
- Display the impact of a potential breach
A penetration test is a good way to display the potential impact of a breach on a given network. It can provide companies with an overview of the worst-case scenario if a threat actor were to gain a foothold on a network and the potential attacks they may be able to carry out. - Uncover improvement opportunities in security habits and current patch management cycles
By identifying attack vectors the assessment highlights various areas of opportunity to improve the security of given systems.
With the constant change in technology as it develops and with new updates and versions constantly released, it is important this is managed well. Companies normally carry out patch management and implement security measures such as policies. A penetration test can assess the current software and hardware versions including the policies and identify any attack vectors and in turn assess the current habits and suggest recommendations. - Identify weaknesses in systems and patch potential attack vectors
A key to a penetration test is the wide variety of attack vectors it can identfy. Penetration tests are not limtied to known exploits and can assess logical flaws, where an automated scan may not oterwise be able to identify. This provides custom information as per the organisation assessed.
- Protect customer data and prevent fines
Organisations normally handle an incredible amount of information which includes personal data. It is important that in an event of a breach that the best security measures are followed. Under the GDPR penalties, fines can vary from £8.7 million or 2% of the annual global turnover to £17.5 million or 4% of the annual global turnover. However, numerous actions can be taken prior to breaches to reduce such penalties, many of which can be covered through best practices that can be assessed in a penetration test. Additionally, a penetration assessment if remediation advice is followed, would limit the possibility of a breach.
This should in turn prevent any further money loss in disaster recovery and potential legal battles as a result of data leaks. - Customer trust
As an organisation it is vital to maintain the trust of your customers. A lack of trust may leads to lack of loyalty.
A penetration test provides companies the ability to avoid such devistating situations. Additionaly, customers are more likely to chose companies who perform regular penetration tests knowing their data is in safe hands.
Why is Penetration Testing so Important?
Ultimately, the cost of training staff, upgrading systems, following security best practices or the cost of a penetration test, will never outweigh the damage of a breach on a network, breach in data or a cyber attack.
Due to the reliance on technology, it is important it is secured properly and assessed once any major changes have been made.
IBM has reports displaying data breaches have increased from around $3.86 million to $4.24 million in 2021 due to remote working. A record high in the past 17 years. This is not to say that remote working is the only vector of attack.
It is reported that 85% of breaches involve a human element, while only 3% involve vulnerability exploitation. Furthermore, a Clark School study was the first to calculate the rate of hacker attacks at 39 seconds on average.
A high-level overview of practices that can reduce the attack vector:
Adopting a patch management cycle that is reviewed often may elevate a large number of vulnerabilities often identified as attack vectors in penetration tests. The use of legacy protocols and obsolete or even outdated software is strongly recommended. If these systems are required, segmentation is recommended followed by a segmentation assessment.
Providing Phishing, Vishing and other Social Engineering training is key to reducing a major vector of attack often used by users with malicious intent. The effectiveness of this training may also be assessed through organised campaigns.
Encouraging employees to use complex passwords is incredibly important. In fact, IBM has reported it is commonly found that compromised credentials are the main cause of breaches with an average cost of $4.37 million. It is often advised to encourage the use of passphrases to make the password easier to remember, but also with a mixture of uppercase, lowercase and alphanumeric characters.
Did you enjoy this blog? Why not take a look at our recent blog covering International Women’s Week