If you’re planning on taking the Security+ exam, you should have a basic understanding of penetration testing. It is an important topic for the exam and it gave me the idea to post this blog.
What is Penetration Testing?
A penetration test (sometimes called a pentest) actively assesses deployed security controls within a system or network. It starts with a vulnerability scan but takes it a step further and actually tries to exploit the vulnerability by simulating or performing an attack.
Security testers typically perform a penetration test to demonstrate the actual security vulnerabilities within a system. This can help the organization determine the impact of a threat against a system. In other words, it helps an organization determine the extent of damage that an attacker could inflict by exploiting a vulnerability.
Although it’s not as common, it’s also possible to perform a penetration test to determine how an organization will respond to a compromised system. This allows an organization to demonstrate security vulnerabilities and flaws in policy implementation. For example, many organizations may have perfect policies on paper. However, if employees aren’t consistently following the policies, a penetration test can accurately demonstrate the flaws.
Many penetration tests include the following activities:
- Verify a threat exists.
- Bypass security controls.
- Actively test security controls.
- Exploit vulnerabilities.
For example, an organization could hire an external tester to test the security of a web application. A first step could check for a SQL injection vulnerability. If the vulnerability exists, the tester could then launch a SQL injection attack to harvest user credentials from a database. The attacker can then use these credentials to exploit other areas of the system. If the database included credentials of elevated accounts, the attacker can use these for privilege escalation and exploit other system vulnerabilities.
Because a penetration test can exploit vulnerabilities, it has the potential to disrupt actual operations and cause system instability. Because of this, it’s important to define boundaries strictly for a test. Ideally, the penetration test will stop right before performing an exploit that can cause damage or result in an outage. However, some tests cause unexpected results.
Testers sometimes perform penetration tests on test systems rather than the live production systems. For example, an organization may be hosting a web application accessible on the Internet. Instead of performing the test on the live server and affecting customers, penetration testers or administrators configure another server with the same web application. If a penetration test cripples the test server, it accurately demonstrates security vulnerabilities, but it doesn’t affect customers.
A penetration test is an active test that can assess deployed security controls and determine the impact of a threat. It starts with a vulnerability scan and then tries to exploit vulnerabilities by actually attacking or simulating an attack.
Part 2 of Penetration Testing covers types of black box testing and more.