MSnet Education

What is Penetration Testing?

Penetration testing (or pen testing), is the simulation of real-world cyber-attack in order to test an organisation’s cybersecurity capabilities and expose vulnerabilities. While some might consider pen tests as just a vulnerability scan meant to check the box on a compliance requirement, the exercise should actually be much more.

The purpose of pen testing is not just to test your environment’s vulnerabilities, but to test your people and processes against likely threats to your organisation as well. Knowing which adversaries are more likely to target you allows a penetration tester to mimic the specific tactics, techniques, and procedures (TTPs) of those specific adversaries – giving an organisation a much more realistic idea of how a breach might occur.

The types of Pen Testing

When considering conducting a pen test, it’s important to remember that there is not a one-size-fits-all test. Environments, industry risks, and adversaries are different from one organisation to the next. Furthermore, there isn’t just one type of pen test that will serve all the needs of an organisation. There are several types of pen tests that are designed to meet the specific goals and threat profile of an organisation.
Below are some of the most common types of pen tests:

1. Internal Pen Testing

Assesses your organisation’s internal systems to determine how an attacker could move laterally throughout your network: The test includes system identification, enumeration, vulnerability discovery, exploitation, privilege escalation, lateral movement, and objectives.

2. External Pen Testing

Assesses your Internet-facing systems to determine if there are exploitable vulnerabilities that expose data or unauthorised access to the outside world: The test includes system identification, enumeration, vulnerability discovery, and exploitation.

3. Web Application Pen Test

Evaluates your web application using a three-phase process:

First is reconnaissance, where the team discovers information such as the operating system, services and resources in use.
Second is the discovery phase, where the team attempts to identify vulnerabilities.
Third is the exploitation phase, where the team leverages the discovered vulnerabilities to gain unauthorised access to sensitive data.

4. Insider Threat Pen Test

Identifies the risks and vulnerabilities that can expose your sensitive internal resources and assets to those without authorisation: The team assesses weaknesses such as de-authentication attacks, misconfigurations, session reuse, and unauthorised wireless devices.

5. Wireless Pen Testing

4. Insider Threat Pen Test

Identifies the risks and vulnerabilities to your physical security in an effort to gain access to a corporate computer system: The team assesses weaknesses such as social engineering, tailgating, badge cloning and other physical security objectives.

MSnet was founded with a passion to assist businesses from the threat of Cybercrime.

Our Mission is to empower businesses with the knowledge, Training and Services required in safeguarding them from Cybercriminal activity.

If you would like more information please reach out our team on 01489 539700 or use the Contact US button below