Finding Weaknesses and Improving System Security
Penetration Testing
Penetration testing is a form of ethical hacking where specialist testers deliberately attack a system on behalf of the organisation that owns it. They use the same kinds of techniques and tools as real attackers, but their aim is to find vulnerabilities before a criminal does, so they can be fixed, patched or otherwise mitigated.
What a test can cover
A test can look at operating systems, applications, program code, authentication, network configuration, encryption and physical security. It shows whether an attacker can gain access, how far they can get once inside, and what they could do — for example, whether someone could reach the membership records of a youth football club and change players' contact details.
External and internal testing
| Type | Who it simulates | What it checks |
|---|---|---|
| External | Someone outside the organisation | Systems reachable from outside, such as a club's online payment page |
| Internal | Someone who already works for the organisation and has an ordinary login, such as a temporary cover teacher's account | What one standard account could reach or change, showing the damage if an account were misused — for example, whether it could open the exam results folder as well as the class register |
How a test runs, and what comes out of it
Testers gather information about the target and identify possible entry points before attempting to break in. If they get access, they may exploit a weakness to demonstrate the risk is real, but never in a way that disrupts the system — a shop's online ordering service must keep taking orders throughout.
Every issue is documented and security improvements are recommended, then reported to the organisation so security and employee practices can improve. Testing is repeated until security reaches a suitable standard, and any change to a system should be tested again, because new features can reopen old gaps. This helps ensure updates, patches and fixes are installed, improves incident response because staff are better prepared, and measures how strong security really is.
Practise this
Pearson BTEC Digital Information Technology · Finding weaknesses and improving system security