Assessing Your Defenses: Penetration Testing for Beginners
by Sarah Harvey / July 12th, 2016
What is Penetration Testing?
Penetration testing is a form of permission-based ethical hacking in which a certified penetration tester attempts to gain access to an organization’s system, network, or web application(s). The purpose of penetration testing is to find vulnerabilities that could potentially be exploited by a malicious hacker as part of a routine security check. This form of security testing allows organizations to find the vulnerabilities in their security infrastructure before someone else does. If you’re new to penetration testing, you’ll need to determine which type of penetration testing is best for your organization.
Types of Penetration Testing
There are a few different types of penetration testing. The type of testing you choose will depend upon what threats you’re trying to eliminate and what level of security testing you wish to have performed.
Web Application Penetration Testing: Web application pen tests evaluate the security of websites, web application, thick clients, etc. The process involves an active analysis, by a GIAC Certified Web Application Penetration Tester (GWAPT), of the application for any weaknesses, technical flaws, or vulnerabilities.
External Network Penetration Testing: An External Network Penetration test helps determine the security of external systems such as routers, firewalls, public-facing servers, etc. from a remote hacker. An external network pen test is performed by a GIAC Certified Penetration Tester (GPEN) who attempts to gain access to sensitive data by exploiting known vulnerabilities, clients, and people via social engineering.
Internal Network Penetration Testing: Internal Network Penetration testing is a simulation of an insider attack who has authorized access or is working from inside the firewall. The target of the attack would be the same as an external test, but an internal would emulate a terminated or disgruntled employee working within the internal network. The purpose of this type of pen test is to find what vulnerabilities exist for systems that are accessible to authorized internal network connections.
Vulnerability Scanning: Vulnerability scanning is a technique used to identify security weaknesses and vulnerabilities in a computer system. By using a commonly available tool to evaluate system configurations against a database of over 80,000 known vulnerabilities, this type of scanning can help identify areas that need remediation.
Social Engineering: The weakest point in an organization’s security posture is its people. Social engineering is a form of attack that depends heavily on human interaction and the manipulation of people to acquire confidential information such as usernames and passwords and other confidential information.
