Penetration Testing

Penetration testing is when an organisation gives authorised experts permission to attack its own system on purpose, so that weaknesses are found and fixed before a real attacker finds them. The testers work inside an agreed scope, which is the set of parts of the system they are allowed to test. That permission is what makes the testing legal: doing the same things without it would be an illegal attack.

What testers try

Testers think like an attacker. They might:

• try to get past a login screen by guessing or cracking passwords;
• try to reach data they should not see, such as another user's records;
• exploit a software flaw, such as a web page that saves uploaded files into a folder anyone can browse, so a document meant to stay private can be opened.

They also test web forms for SQL injection by typing crafted text into a search or login box, to see whether the site passes it straight to the database and hands back data that should stay hidden.

After the test

Testers fix nothing themselves: they write a report listing each weakness, how they reached it and how serious it is. The organisation then fixes the problems, for example by updating the program, tightening the code behind a form or changing permissions, and may ask for a second test to check the fixes worked. For example, a college's booking system is tested and an old page is found that lets testers open a tutor's admin screen; the page is rebuilt and the test repeated.

Why it counts as prevention

Penetration testing does not block an attack as it happens, in the way a firewall filters traffic. It leads to the weakness itself being removed, so there is nothing left for a real attacker to use. It is one of several methods used together, because no single method stops every threat.