| A penetration test is an assessment of your | | | | approach the testing. |
| network's security, including potential | | | | |
| vulnerabilities and how they could be | | | | Basically, your approach is determined by |
| exploited. Businesses and individuals perform | | | | your answers to these two questions: |
| penetration tests in order to pinpoint and | | | | |
| correct potential ways an individual could | | | | 1. Who is the hacker? (Disgruntled employee? |
| gain access to their network. Penetration | | | | Someone with no inside information or |
| testing is similar to ethical hacking in that | | | | connection to the company?) |
| a trusted individual is given permission to | | | | |
| attack a network using the same methods as | | | | 2. How much (if any) notice/information will |
| those employed by an illegal hacker. | | | | you give your IT staff and/or employees about |
| | | | the testing? |
| The first step in conducting a penetration | | | | |
| test is planning. Before the testing begins, | | | | For example, if you want to know what a |
| you should set out goals, time tables, and | | | | disgruntled employee could do, the testing |
| parameters. That is, determine your major | | | | will physically take place within the walls |
| concerns, decide which aspects of your | | | | of the company, using the company's computers |
| network you want tested, and decide how long | | | | and equipment. Another scenario, as mentioned |
| and when the testing will be conducted. | | | | above, is one where the hacker has no special |
| | | | access; they are simply working from their |
| The second step consists of gathering | | | | own computer and attempting to breach your |
| information. Here is where the tester puts | | | | network via the Internet. |
| themselves into the shoes of an illegal | | | | |
| hacker. Imagine you're the hacker, and all | | | | The answer to the second questions determines |
| you have is the name of a company or its | | | | whether, and how, you'll involve your staff |
| website. This company is your target, and | | | | and employees. For instance, you may decide |
| your goal now is to dig up as much | | | | that one of your goals is to find out if your |
| information as you can to help you break into | | | | IT staff will be alerted to attempted |
| their network. | | | | break-ins. In that case, you would not give |
| | | | them any advance notice of the testing. |
| Third, the tester will manually test all of | | | | Conversely, you could decide to have your IT |
| the information gathered for possible | | | | staff and the penetration testers work |
| vulnerabilities. That is, they'll pull all | | | | together, focusing on a specific target. |
| the hacker tricks out of their hat, so to | | | | |
| speak, and see where and in what ways the | | | | Related to the two questions above is the |
| system is vulnerable. | | | | issue of "zero knowledge penetration testing" |
| | | | versus "limited knowledge penetration |
| Last is the actual "break-in" itself. The | | | | testing." With the zero knowledge approach, |
| tester starts by selecting a target. For | | | | the testing team has been given no knowledge |
| instance, the tester could focus in on the | | | | or information about the system and network |
| network's main server. From the research done | | | | from the company. Many consider the zero |
| during the third step, the tester has an | | | | knowledge approach to be the most realistic, |
| arsenal of weapons and potential ways into | | | | given that the potential attacker would be |
| the network. Now it's a matter of using that | | | | starting from scratch with regards to the |
| information to hack into the targeted server. | | | | hacking. |
| | | | |
| Once the testing is complete, the tester | | | | The alternative is "limited knowledge |
| provides the company with a report detailing | | | | penetration testing." This approach can save |
| the vulnerabilities and explaining how to | | | | both time and money. With limited knowledge |
| correct them. | | | | testing, the testing team is given the basic |
| | | | knowledge that a hacker would have come up |
| Obviously, the overarching goal of | | | | with on their own anyway. That way, the team |
| penetration testing is to uncover holes in | | | | can move directly to the vulnerability |
| your network security. There are, however, | | | | assessment phase. |
| several different perspectives from which to | | | | |