“Foolproof systems don’t take into account the ingenuity of fools. “- Gene Brown

Introduction

Many of us will agree that Penetration Testing is a commonly misunderstood security discipline often confused with simple automated scanning services or the occasional use of internal software tools to assist in passing an audit of one kind or another. But in real, Penetration Testing is an authorized, proactive attempt to measure the security of an IT system by safely exploiting its vulnerabilities, mostly to evaluate application flaws, improper configurations, and risky end-user behavior.

The security assessment of internet / intranet facing system test helps discover the vulnerable network services that can be exploited by unknown threat sources the common categories of vulnerabilities. Vulnerabilities can vary from remote system & password compromise, web server, database, network service, network device, directory and miscellaneous non-configuration to information disclosure to weak cryptography. This array of vulnerabilities propel the imperative need for a holistic Penetration Testing Process.

Why Penetration Test?

High-profile attacks on companies including Sony Pictures, JPMorgan and Home Depot last year, among hundreds of others are enough to show hackers have become master hurdlers and are able to jump both the firewalls erected around a corporate network and internal fences.
Reasons that press harder for the need for Penetration Testing encompass concerns like threat identification, perimeter security evaluation, certification of industry regulations, IT security cost control, anti-vulnerability solutions, legal compliance, and validation of security protection and most importantly, justify return on security investment.

The cyber threat landscape is certainly changing at high frequency. With well-designed processes and the right combination of skill sets and technologies, penetration testing can yield exceptionally critical and highly-valuable results. Penetration testing will help you to better:

• Identify complex/hard-to-find vulnerabilities susceptible to known attacks
• Validate an organization’s ability to detect and respond to attacks
• Illustrate the business impact associated with identified vulnerabilities
• Improve decisions related to tools, process, and people assigned to reduce vulnerabilities
• Avoid the many and varied costs associated with network downtime and cleanup projects
• Meet regulatory requirements and avoid fines
• Preserve corporate image, protect you brand, and strengthen your customer loyalty
• Protect business partner relationships
• Justify needed security investments
• Satisfy prerequisites for cyber security insurance

Types of Penetration Testing

External Network Penetration Testing

External Penetration Testing consists of a reviewing and assessing the vulnerabilities that could be exploited by external users/Hacker without any credentials or without having any access to target system. The goal of the external network Penetration Testing is to demonstrate the existence of known security vulnerabilities that could be exploited by an attacker as they appear outside the perimeter of the network, usually from the internet. External testing involves analysis of publicly available information, a network enumeration phase and the behavior of the security devices is analyzed. All web servers, mail servers, firewalls, routers, IDPS, etc should undergo the Penetration Testing activity to evaluate the security posture.

Internal Network Penetration Testing

Internal penetration testing often exposes the ability to compromise a web application server from inside the firewall. Internal network Penetration Testing reveals the holistic view of the security posture of the organization. An internal network security assessment follows a similar technique to external assessment but with a more complete view of the site security. Testing will be performed from a number of network access points, representing each logical and physical network segments. For example, this may include tiers and DMZ’s within the environment, the corporate network or partner company connections.

Third-party Pen testing

Many organizations have a legal or compliance requirement to have an external party perform at least one penetration test per calendar year. In addition to this, it’s a good idea to have external firms perform some tests that require extensive knowledge on platforms that your team may not know well, or tests your team is not capable of performing for some other reasons.

Summary

A penetration test is the MRI for your business. It’s the real-world security testing of the requirements you believe are in place. It’s a way to actually see evidence of problems your security systems may have. If compromised merchants had tested their environment through a penetration test, they might have found the vulnerability that allowed attackers into their system, before it happened.