What is Penetration Testing?

A penetration testing or pen test is a targeted cyber attack to check for vulnerabilities on computer systems. Penetration is the common type of test done to understand how a hacker could hack into the company’s network. Penetration testing involves a process in which involves gathering information on the target system, identifying the entry points, breaking in, and report generation.

Penetration testing process or stages

Penetration testing always involves several stages. Planning, Scanning, Gain access, Maintain access and Analysis.
Stage 1: Planning
The first stage of Penetration testing is understanding the computer network that we are trying to hack. Gathering information on the computer system and planning and the attack.

Stage 2: Scanning
The next part of the process is to analyze the various entry points to intrude into the computer network. This is about analyzing an application or a computer network in running condition and in a standby mode. Static analysis inspects the applications’ code or computer network while stand-by condition to see how it’ll work while it’s running and check for entry points. Dynamic analysis inspects the application or computer network while it is running.

Stage 3: Gaining Access
In this stage, the hacker will try to attach a computer system or network with various techniques and find the vulnerabilities on the target network. Furthermore, using these exploited vulnerabilities hackers try to steal files, information, plant viruses, malware to damage the information.

Stage 4: Maintaining Access
This step is done to see how long an attack has its presence on the network. Usually to gain some in-depth sensitive information about an organization malware will be implanted in the network for an extended period. This step determines if the vulnerability in the system allows the attack to stay in the system for a longer period.

Stage 5: Report Generation and Analysis
The results are noted and compiled into a report. The report will have the entire details about the attack, what are the vulnerabilities found, the sensitivity of the data accessed, how long the attack was placed on the network undetected.

Penetration testing methods

There are different types of pen testing used to find the vulnerabilities in a computer network
External Testing
As the name suggests, this pen testing method targets the information already available on the internet such as company website, web applications, online forms, etc. External testing tests the components outside the company’s firewall.

Internal Testing
Internal testing is done on the back-end side of the organization, the information protected by the firewall security. This will be initiated with an inside malicious attack. It can either be an inside employee or a stolen credential of an employee.

Blind Testing
In this method, the tester will be given only the name of the organization. The type or target will be chosen randomly by the tester. The security personnel will be given heads-up on the attack. This will be an excellent training exercise in which they will have a real-time idea of how the system gets attacked.

Double Bling Testing
In this double-blind test, security personnel will not have any knowledge of the threat. It would be like a real cyber attack on the company’s system or network. This makes it much more effective as the security personnel will not have any time to prepare or secure their defenses as in real-time scenario.

Targeted Testing
Targeted testing is where both Tester and Security personnel works along with each other with continuous feedback and appreciation. This is just like a simulation where the tester attacks a targeted system and the security personnel tries to rescue it.

How often should you do Pen testing?

Penetration testing should be performed regularly by the organization to avoid any attacks and to ensure more consistent network. Ideally, pen testing should be done on computer systems at least once a year or whenever the organization

• add or introduce a net network
• establish a new office location
• applies security upgrades

or

• updates to the application