On the digital battleground, enterprises need a way to make sure their defenses work. Penetration testing (or ‘pen testing’) offers the type of attack you might encounter, but in a controlled case. With pen testing, people intentionally attack an app or network to check on its security posture. This lets enterprises realistically test the effectiveness of their digital security program. A group of technicians use their experience, along with specialized penetration testing tools, to probe defenses in search of vulnerabilities, misconfigurations and other weaknesses. Let’s take a look at how pen testing works, its pros and cons and how it might apply to your organization.

What Is Penetration Testing?

Penetration testing generally comes in one of three different methods. These are as follows:

  • Black box penetration testing: This type of pen testing emulates a real-world digital attack where the intruder doesn’t know the organization’s underlying infrastructure, applications or source code. They’ll use automated processes for an extended period of time to search for vulnerabilities in a trial-and-error approach.
  • White box penetration testing: As opposed to a black box pen test, a white box pen test is where a tester has full knowledge of the underlying architecture and source code. They can use this knowledge to conduct a thorough examination in less time. However, they’ll need specialized tools and potentially more time to figure out what to focus on before getting started.
  • Gray box penetration testing: A blend of black box and white box testing, a gray box pen test uses both manual and automated methods. The testers use what they know to find weaknesses, exploit them and see how far their false attacks can take them.

Using one of these approaches, the testers can then perform one of several pen testing exercises. First, they can conduct network penetration testing, perhaps the most common type. They search for vulnerabilities in the network infrastructure both locally at the client side and remotely from the outside world. Next, they can plan for and invest in a web app pen testing engagement. In this case, they check the endpoints of all web apps. They can test for client-side security holes that emerge locally. This kind of test can also spot areas of human weakness that open businesses up to social engineering attacks.

So how is pen testing different from other types of testing? For example, red teaming mimics a pen test in that false attackers have a set goal for the exercise. But red teaming simulates an advanced threat actor using evasion and stealth to test how an organization’s defenders (known as the “blue team”) respond. In contrast, blue teams know about a pen test beforehand.

Pen testing is also not the same as having a public bug bounty program, which invites hackers and security researchers to report real vulnerabilities in exchange for a bounty.

The Benefits and Challenges of Penetration Testing

The benefits of a pen test are many. It’s one of the primary means by which organizations can build a list of documented vulnerabilities and risks. At that point, you can rank those risks based upon their impact to the business and fix them accordingly. This will help ensure business continuity by preventing an incident from disrupting crucial work. It can also protect clients and partners as well as review (and possibly make changes to) their existing security investments.

That said, pen testing isn’t without its challenges. Pen testers are consultants who might be double-booked across multiple engagements. As a result, they might be limited in the time they have to try to penetrate a client’s network, and in that time, they might try to reuse tactics that worked against other clients. This type of approach might not represent the real security threats confronting different groups potentially spread across different industries — more so when just a couple of people from the same company are conducting pen tests just a few times a year.

Last but not least, pen tests might point out vulnerabilities, but these engagements are not folded into organizations’ security programs. So these entities might lack the resources and workflows to address them in a timely manner.

How to Maximize the Impact of a Penetration Test

Keeping in mind those challenges, organizations need to invest in maximizing the impact of their pen tests. First, focus on how to best prepare for one. This should involve planning well in advance for the test by providing a sufficient plan that documents the in-scope systems to the testers.

Next, contribute to a smooth test by not fixing things unilaterally while the engagement is in process. That’s not to say you can’t implement security fixes during the test. But you should be in contact with the testers about their decision. This prevents you from holding up an engagement and forcing the testers to keep circling back to the same systems as changes are made.

Organizations also need to act upon the results of their pen testing once it’s done. Part of this involves fixing specific issues found by the testers. But it also involves reviewing and augmenting vulnerability management programs, threat intelligence feeds and other security best practices.

Combine Pen Testing With Other Tactics

Last but not least, organizations need to remember that they are not bound to one form of security testing. They can engage in different pen testing tactics and different types of pen tests. They can also establish an ongoing bug bounty program as well as explore other security testing paradigms, such as redteaming. Together, these tests can provide their own unique glimpse into an organization’s security strengths and weaknesses. The organization can then use that knowledge to harden its digital security posture going forward. They’ll have the assurance they’ve already faced some of what an attack could bring.

More from Risk Management

Operationalize cyber risk quantification for smart security

4 min read - Organizations constantly face new tactics from cyber criminals who aim to compromise their most valuable assets. Yet despite evolving techniques, many security leaders still rely on subjective terms, such as low, medium and high, to communicate and manage cyber risk. These vague terms do not convey the necessary detail or insight to produce actionable outcomes that accurately identify, measure, manage and communicate cyber risks. As a result, executives and board members remain uninformed and ill-prepared to manage organizational risk effectively.…

The evolution of ransomware: Lessons for the future

5 min read - Ransomware has been part of the cyber crime ecosystem since the late 1980s and remains a major threat in the cyber landscape today. Evolving ransomware attacks are becoming increasingly more sophisticated as threat actors leverage vulnerabilities, social engineering and insider threats. While the future of ransomware is full of unknown threats, we can look to the past and recent trends to predict the future. 2005 to 2020: A rapidly changing landscape While the first ransomware incident was observed in 1989,…

Defense in depth: Layering your security coverage

2 min read - The more valuable a possession, the more steps you take to protect it. A home, for example, is protected by the lock systems on doors and windows, but the valuable or sensitive items that a criminal might steal are stored with even more security — in a locked filing cabinet or a safe. This provides layers of protection for the things you really don’t want a thief to get their hands on. You tailor each item’s protection accordingly, depending on…

The evolution of 20 years of cybersecurity awareness

3 min read - Since 2004, the White House and Congress have designated October National Cybersecurity Awareness Month. This year marks the 20th anniversary of this effort to raise awareness about the importance of cybersecurity and online safety. How have cybersecurity and malware evolved over the last two decades? What types of threat management tools surfaced and when? The Cybersecurity Awareness Month themes over the years give us a clue. 2004 - 2009: Inaugural year and beyond This early period emphasized general cybersecurity hygiene,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today