Penetration Testing

Penetration testing (pen testing) is the deliberate attempt to find security holes in an organisation's own systems, carried out with the permission of the organisation that owns them. Testers break in on purpose, but they are on the organisation's side.

Finding a weakness before an attacker does is the whole point. If a tester finds an unlocked door into the network, the organisation can lock it; if a criminal found it first, data could be stolen, changed or destroyed. Penetration testing therefore lets an organisation fix weaknesses and reduce risk rather than wait to be attacked.

What a test involves

A test follows four stages:

1. Identify targets of potential attacks — decide which servers, databases or accounts are worth attacking, such as the system holding customers' payment details.
2. Identify possible entry points — look for ways in, such as an out-of-date login page or a router still using the default admin password.
3. Attempt to break in — try the attack, carefully, to prove the entry point really works.
4. Report the findings — write up what was found and how serious it is, so the organisation knows what to fix first.

For example, a tester for a chain of bike shops might find an old order form that lets anyone view past orders. After breaking in to prove it, they report it and the shop fixes the form.

White box and black box

A test can be white box or black box. In a white box test, the testers are given credentials and system information, so they simulate an attack by an insider and can test what someone with authorised access could do. In a black box test they get no inside knowledge, so they attack from outside as an external hacker would.

Either way the test is authorised, because the owner has given permission, so it is not a criminal attack. Even a thorough test does not prove a network has no weaknesses — it only shows that the weaknesses the testers looked for were not found or have been fixed.