A Simple Guide to Successful Penetration Testing

How effective are your existing security controls against a skilled adversary? The best way to find out is by running a penetration test. As this security practice becomes increasingly common, it can feel more difficult to ask, “what exactly is penetration testing?” This guide aims to not only answer this question, but to also explain how penetration testing began, who performs these assessments, why every organization benefits from them, and where to begin when incorporating penetration testing into your own security strategy. 

At its core, penetration testing is simply thinking like an attacker. In this sense, the idea of penetration testing can be traced back to the fifthcentury B.C. In the military treatise attributed to Sun Tzu, The Art of War, it’s written that “If you know the enemy and know yourself, you need not fear the result of a hundred battles.”

When it comes to practice, pen testing has still been around for longer than you may expect. Since the 1960s, experts have been expressing the urgent need for prioritizing cybersecurity, recommending approaches like security testing. This brief timeline highlights key points in the development of modern penetration testing.

The scope of a penetration test should include what is tested, objectives, who will be involved in the testing process, and who needs to know a test is occurring. A common misconception of penetration tests is that each one tests an organization’s entire infrastructure. This can sometimes make running a penetration test seem like too much of an undertaking—too costly and time consuming. However, while some engagements of small businesses may be able to cover the whole IT environment, it’s far more common to have a much narrower scope. In fact, too broad of a scope only allows pen testers to scratch the surface of a number of vulnerabilities, instead of gathering valuable intelligence gained by going more in-depth in fewer areas, with clear objectives in mind.

When determining the parameters of your penetration test, here are a few things to consider:

Objectives. What insights are you hoping to gain from your pen test? If an outside attacker can get any sort of access? If an internal threat actor can escalate their privileges to root access? Getting a sense of your primary concerns can help lay the foundation for a well-defined engagement. Once this question is answered, it can help clarify both the type of access a pen tester should start out with, and what assets they should target.

Boundaries. Where are the limits of where a penetration tester can go? There may be multiple reasons for why you want to draw lines that a tester should not cross. You may not want certain business areas disrupted, or there may be areas that are simply a low priority. Often, organizations run vulnerability scans to find out which areas are free of vulnerabilities, and which need further investigation.

Test Types. Once you have an idea of what assets you’re concerned about, this can help determine what test types need to be run. Some of the most common ones include:

Along the way, other questions may come up that can further refine your scope. Ultimately, taking the time to outline exactly what you want to get out of a penetration test ensures that you will get a complete picture of the security within the are you are testing, with an idea of what security controls are working, what is still needed, and what vulnerabilities should be fixed first.

A successful pen test is a multi-phased project that is both thorough and well thought out. While the scope of penetration tests often varies, the steps that should be followed for any engagement remain the same.

As with all aspects of cybersecurity, there is a lot of jargon often thrown around when discussing penetration testing. While by no means a comprehensive list, here are a few key terms worth remembering. 

Adversary – A person or group that intends to launch a cyber-attack against an IT infrastructure, for the purposes of stealing data, extorting money, or disrupting production. In an adversary simulation, a cybersecurity expert will emulate this role in order to test the strength of an environment’s defenses.  

Attack Chain –  The act of pivoting from one attack into launching another in order to achieve a goal, typically for gaining control of the entire domain.

Exploit – An exploit is a piece of code that takes advantage of a known or unknown vulnerability located within an asset.

External Threat – The risk of an outside attack that begins outside of the security perimeter and is committed by an individual or group that is seeking to gain access to the environment’s data or functionality.

Insider/Internal Threat – The risk of an attack initiated from inside the security perimeter, either purposefully or accidentally, by those that already have access of some kind, like an employee, contractor, or someone who has stolen credentials.

Patch – A release of changes to a computer program or its supporting data designed to fix bugs or other issues.

Phishing Simulation – A type of social engineering testing that imitates phishing campaigns. Pen testers deploy a number of phish emails of varying difficulty levels, and monitor whether any are opened, clicked, or have credentials entered.

Privilege Escalation – Typically achieved by exploiting a security weakness, the act of gaining additional access, resources, and control within a domain.

Remediation – Measures taken to correct or compensate for uncovered security weaknesses or vulnerabilities. Retest exploited systems after a penetration test to verify that remediation measures or compensating controls are effective and working.​

Vulnerability – A weakness within an asset. Some vulnerabilities have the potential to be used by threat actors to gain access to an environment, or for some other malicious purposes. Not every vulnerability can be exploited.

Vulnerability Management Program – A comprehensive approach to the security stance of an entire infrastructure, often consisting of processes such as asset analysis, vulnerability scanning, penetration testing, patch management, and new process implementation.