What is Penetration Testing?

What's pen testing https://www.nopsec.com/our-services/penetration-testing/ and how is it different from a vulnerability assessment? What are the different types? Check out this presentation to know the basics!

Transcript

1. What is Penetration Testing?
2. Security Security has always been of major importance: we have built a lot of complex systems in an effort to keep ourselves safe. As we have advanced in our security systems, the human mind has also advanced in its desire to compromise and defeat such systems – it’s in our nature (whether for good or for worse)
3. Battle There is a constant battle between security and the ever-scheming human mind of malicious attackers. Having a good cybersecurity program helps you accept that risk and you have a reasonable expectation that your organization can withstand an attack and achieve resiliency.
4. Testing Testing your cyber security program to know its vulnerabilities against diverse attack vectors is what penetration testing is about. Pen testing does not just test a company's security system to determine its weak points and give you list, in this test, the weak points are actually exploited.
5. Proving Effectiveness In a pen test, the vulnerabilities are exploited to either prove the effectiveness of the company's security system or to disprove it against real world attacks. The company's assets, data, IT, human employees, or security systems (depending on scope) will all be fair game for an attack.
6. Attacker’s Motivation Although computers and other tools may be involved in the test, the aim of the test is not to determine what set of automated tools can beat the security system. Instead, the focus is the tenacity, creativity, and motivation of the attacker. The human mind is elastic and is capable of extraordinary things
7. Privilege Escalation The test employs various attacks to try to compromise the system. This is because a successful high-level breach is most often a cumulative effect of a low-level security breach, with privilege escalation is vastly more common than a hole-in-one at first attempt.
8. Purpose... • Upgrade the company's security system in the event of a failure. The attack can be recreated by means of forensic analysis. Also, the vectors will be identified and the system upgraded to prevent future attacks. • For compliance with government requirements, The Payment Card Industry Data Security Standard requires annual penetration tests, and so does HIPAA and the NYDFS.
9. More Purpose... • Assessing the impact on business in case of a successful attack. • Identifying vulnerabilities that cannot be detected by either software or by automated systems. • Ascertaining the readiness of the company's security system to respond to attack.
10. Reasons There are many more reasons for carrying out penetration tests, but these above are some of the major reasons why they are conducted. The desires and goals of the company are actually what determine the purpose of the test. In some cases, the company just wants to ensure that they have complied with the provision of the regulatory body in conducting a test. In others, the company may be concerned about its data assets or employees. In each case, the company will determine the purpose and the scope of the test.
11. Different Types • Black Box • Whote Box • Others
12. Black Box Black box Test is conducted with the vector team or individual sourcing for information from scratch, without the company giving any help. The vector will gather information from OSINT sources, and possibly from the media. The team can also gather information from staff but not overtly, most times it can be done even without the staff knowing that valuable information has been divulged. This test requires more time and capital but can give the company valuable information on how possible vectors will get their information.
13. White Box White box Test is conducted with some information already provided by the company. This shortens the time to get such information and also simulates what may happen in case a trusted staff that has security codes or high-security clearance assists the attacks.
14. Others Both tests have their advantages as already mentioned and their disadvantages. The company should know which of the tests best suits their needs. There are other tests such a Gray box, but it is less common.
15. Before You Test Before carrying out a test, every business should determine the following: • The integrity of the firm they are employing to conduct the test. • State the scope clearly and what should be included in the recommendation after the test. • Schedule the test to prevent interference with business activities, or have some controls in the event that a test disrupts any business activities.