Most people are familiar with the phrase “pen test”. However, not many people know precisely what a pen test entails. It can be difficult for an organisation to make the decision to undergo a pen test if it does not know what to expect. This blog post guides you, step-by-step, through what actually happens during a pen test.

Step 1: Information Gathering

Many companies move to the cloud on the promises of the greater protection that it provides. However, by choosing public over private cloud, you may be exposing yourself to new risks. In the public cloud, resources are shared which means that there is both a larger attack surface area and a greater chance of an attack happening.

The first step involves agreeing upon the scope of a pen test. The tester and the organisation must decide what type of pen test is required as well as its duration.

There are three types of pen tests:

1. Black-box pen testing – here the tester is not given any access to the organisation’s applications or networks. Instead, they must carry out reconnaissance to obtain the information needed to carry out the pen test. This type of test simulates a cyberattack.
2. Grey-box pen testing – with this type of pen test, the tester has access to some of the organisation’s applications or networks. The level of access granted may mirror that of an employee with lower-level credentials. This type of test simulates an attacker that has already penetrated the perimeter of an organisation.
3. White-box pen testing – this type of test grants the tester open access to all applications and systems as well as high-level privilege to access networks. A white-box pen test allows logical vulnerabilities – which relate to how applications make decisions –to be detected. This type of test mimics that of a malicious attacker who has more access and information than an outside attacker would have.

Step 2: Reconnaissance

This next step entails the tester carrying out reconnaissance to uncover information available about your organisation that malicious actors may utilise to launch an attack on you. This may be quite a lengthy part of the process, particularly if you choose to undergo a black-box pen test.

Step 3: Vulnerability assessment

The third step involves the tester identifying any known vulnerabilities which they may be able to exploit. Known vulnerabilities are documented weaknesses which may be used by cyber criminals to gain access to an organisation’s information.

Cyber criminals often rely on known vulnerabilities to exploit their target organisation. Thus, it is important that ethical hackers identify how well an organsiation would withstand an attack which relies on these vulnerabilities. Indeed, the better known a vulnerability is, the more urgently an organisation should address it.

Step 4: Exploitation

This is the “pen” part of pen test. Now that the tester has established what they are testing, the level of access, and the known vulnerabilities, they may begin the pen test.
This step involves placing all of the organisation’s cyber security defences under scrutiny and establishing how well they would withstand an attack.

Step 5: Analysis and Review

The tester then prepares a report which analyses the organisation’s performance. This report outlines the organisation’s strengths and weaknesses. Additionally, the tester may categorise risks and identify those which need to be addressed with greater urgency.

Step 6: Recommendations

Our team makes recommendations on how to address any risks your organisation faces. We help you to improve your cybersecurity posture and bolster your defences.

Conclusion

Pen tests play a key role in bolstering a company’s cyber security defences. However, it may be difficult for an organisation to commit to undergoing one when they do not know what to expect.

At Stryve, our pen tests get underway with little disruption to you and your organisation. If you would like to speak to one of our experts about our penetration testing service, please make an appointment below.