What is Penetration Testing and How Does It Work?

This article was provided by Software Secured, a Pima partner in providing quality penetration testing ledby human hackers. Link to original post here.

What is Penetration Testing?

Penetration testing is a one-time security exercise that tests the resilience of your application or network. It involves a team of white hack or ethical hackers who are hired to break into your application and find security vulnerabilities to exploit.

‍

In such a way, they do exactly what the bad actors would do when trying to access your application. Except, penetration testers are ethical hackers, so they’re ready to alert and inform you of vulnerabilities immediately.

‍

In some cases, penetration testing providers may also offer you security remediation advice.

‍

Penetration Testing as a Service (PTaaS) is an extended, more comprehensive form of penetration testing that provides year-round coverage. Whereas a one-time test is great for providing a baseline of your security posture, PTaaS will test your application multiple times per year, plus provide security consulting and fix verification testing throughout the year as well.

Who Performs Penetration Tests

Pentests are performed by penetration testers (or pentesters, for short). Pentesters are expert security engineers who understand risks such as OWASP Top 10. Using a combination of manual and automated testing, they can creatively apply their unique areas of expertise to locate known vulnerabilities and often even exploit new issues.

Depending on their background, penetration testers may have various areas of expertise. For example, they may be proficient at finding one type of vulnerability (such as XSS), or may excel at certain types of penetration tests (such as mobile pentests).

Difference Between PenetrationTest and Vulnerability Scans

Vulnerability scanning tools such as SAST,DAST, IAST and RAST are quite common for organizations that want to quickly scale their security testing on the cheap. However, these tools aren’t able to dive as deep into code and can often miss critical vulnerabilities. As such, using only vulnerability scanning tools may actually be giving your organization a bit of security theater.

While vulnerability scanning is quite different from penetration testing, it is still an important part of a comprehensive security posture.

Types of Penetration Tests

 Most penetration testing vendors offer the service in two forms: baseline penetration testing and penetration testing as a service (PTaaS).

Baseline Penetration Testing

 Baseline pentesting is better suited for clients that need a one-time check on their security. Best cases for getting a baseline pentest include:

●     A small start-up who doesn’t have the budget for more security coverage

●     A company earning compliance for the first time who needs a security assessment done as part of the compliance requirements

●     A company involved in an M&A deal who wants to use security as a measure to help valuate a company

●     A B2B company closing enterprise deals, who may be completing many vendor security questionnaires

Penetration Testing as a Service(PTaaS)

 PTaaS is a more comprehensive approach to security testing, as it integrates security as part of the SDLC. As code is deployed, it is continuously tested to ensure a higher level of application security year-round. In addition, it includes consulting, more re-testing, and better access to security expertise for development teams.

Best cases for getting PTaaS include:

●     A company who wants to increase the performance and value of their application through security

●     A company who wants to integrate security as a part of the Dev/DevOps pipeline

●     A company who wants to streamline security processes across multiple projects or applications

Penetration Testing Stages

There are 7 key stages in an effective pentest:

1. Reconnaissance

This stage is all about understanding the application and its unique business logic. Meetings with the client and pentest provider help ensure that all parties are well-informed about the test. The test environment must be ready at this point.

2. Threat Modeling & CustomSecurity Plan

Building out a threat model is essential to understand the common use cases of the application. An effective threat model can also identify security risks in the design of the application, which may be difficult to change at a later stage. But understanding these risks early helps prepare the rest of the security plan to work around them.

3. Automatic & Custom Script Developments

The fun begins. Pentesters start diving deep into the application with a mix of manual and automated approaches.

4. Identification of 0-day Vulnerabilities

As critical vulnerabilities are identified, the client is notified immediately. Steps to reproduce the issue are shared with the client so that the client’s development team can begin remediation as soon as possible.

5. Exploitation and Escalation

The less severe vulnerabilities found during the early stages of the pentest are exploited and escalated as much as possible without affecting the function of the application (ie if a pentester is testing a vulnerability and it risks taking down the entire application, they’ll take it as far as possible without creating any actual harm). Test environments and test accounts are created for this reason - to prevent any real damage and exploitation to the live application.

6. Cleanup and Reporting

When the test is complete, pentesters will gather all found issues (regardless of severity) into a report. A good penetration testing provider should also include steps for replicating the issue so that the client’s development team can mitigate the issue.

7.Retesting and Certification

After the report is delivered, the client may patch several vulnerabilities. A quality pentest provider will be able to retest these known vulnerabilities shortly after to verify that they have been fixed correctly or sufficiently. In some cases, the pentester may require that the client develops a complete fix, and in other cases a “band-aid” solution may suffice for critical issues that need deeper attention later.

When all is good to go, the pentest provider can offer a certificate to the client as proof of application security. This certification is essential when earning compliance such as SOC 2 or ISO 27500.It’s also helpful for closing enterprise deals (learn more about vendor security questionnaires here) or for startups that want to generate higher investor appeal.