What is a pen­e­tra­tion test (pen test)?

With pen­e­tra­tion tests (often referred to as pen tests), it’s possible to determine the like­li­hood of an attack on your network, including in­di­vid­ual systems within the network as well as specific ap­pli­ca­tions. Find out how such tests are conducted and what they mean for a network that is already in use.

What is pen­e­tra­tion testing?

In the IT sector, a pen­e­tra­tion test is a planned attack on a network of any size or in­di­vid­ual computers that aims to uncover vul­ner­a­bil­i­ties. To achieve this, various tools are used to simulate different attack patterns, which are modeled around common attack methods. Typical com­po­nents that undergo a pen test are:

• Network coupling elements such as routers, switches and gateways
• Security gateways such as software and hardware firewalls, packet filters, virus scanners, load balancers, IDS and IPS etc.
• Servers such as web servers, database servers, file servers etc.
• Telecom­mu­ni­ca­tion systems
• All types of web ap­pli­ca­tions
• In­fra­struc­ture in­stal­la­tions e.g., control access mech­a­nisms
• Wireless networks that are part of the system such as WiFi or Bluetooth

Testing is normally divided into black box, white box and gray box testing: With black box testing, pen­e­tra­tion testers are only given in­for­ma­tion about the address of the target network or system. With white box testing, the testers have extensive knowledge of the systems they are going to test. In addition to the IP address, they also receive in­for­ma­tion about the software and hardware com­po­nents being used. Gray box testing, which is the most common form of pen­e­tra­tion testing, combines black box and white box testing methods. Basic in­for­ma­tion about the IT in­fra­struc­ture is made available, such as what the systems are used for and their general makeup.

What do I need for a pen test?

How can you create a custom pen­e­tra­tion test for your own network? Below you’ll find essential in­for­ma­tion about what you need to consider when con­duct­ing a pen­e­tra­tion test.

How can I prepare for a pen test?

To suc­cess­ful­ly conduct a pen test, it’s important to first establish a clear plan. Identify which com­po­nents need to be tested, whether you have all the necessary tools on hand and the timeframe for each in­di­vid­ual test as well as for the overall as­sess­ment of your network.

The prepa­ra­tion phase is even more critical if you’re hiring external testers, and you want to use the white box testing method. If this is the method you want to use, you’ll need to provide the testing team with all the in­for­ma­tion about your network and its systems as well as with the doc­u­men­ta­tion you have for your system. For a black box test, the process is different. With this method, you’ll only need to disclose the target addresses of the com­po­nents that should be tested.

What are the best tools for pen­e­tra­tion testing?

Since there are so many different kinds of attacks, it makes sense to have lots of different tools available for pen­e­tra­tion testing. Some of the most important ones are:

• Port scanners: Port scanners use spe­cial­ized tools to identify open ports in a system.
• Vul­ner­a­bil­i­ty scanners: Vul­ner­a­bil­i­ty scanners examine systems to check for existing security vul­ner­a­bil­i­ties, faulty con­fig­u­ra­tions and in­ad­e­quate password and user policies.
• Sniffers: A sniffer is used to analyze network traffic. The stronger the en­cryp­tion, the less in­for­ma­tion it will be able to gather.
• Packet gen­er­a­tors: Packet gen­er­a­tors are tools used to generate or simulate network traffic data. This makes it possible to mimic network traffic during a pen­e­tra­tion test.
• Password crackers: Pen testers use password crackers as a way to obtain passwords that aren’t secure.

Many of the tools listed above have been ex­plic­it­ly developed for network security tests and as a result, are tailored to specific test areas. While the vast majority of these programs come from the open-source sector, there are some com­mer­cial security ap­pli­ca­tions, which are generally better doc­u­ment­ed and come with com­pre­hen­sive IT support.

What are the different steps of a pen­e­tra­tion test?

The test procedure for a pen test can be divided into the following four steps:

Review network concept

A pen­e­tra­tion test can reveal in­con­sis­ten­cies or weak­ness­es in the design of a network or in in­di­vid­ual com­po­nents as early as the prepa­ra­tion stage. For example, if multiple ap­pli­ca­tions are con­fig­ured with different access groups, they can quickly create com­pli­ca­tions and present a security risk for the entire network, even if the network and in­di­vid­ual hosted programs are ad­e­quate­ly protected. Some of these cases can already be resolved during a pre­lim­i­nary dis­cus­sion, while others can only be confirmed by carrying out a practical test.

Test hardening measures

Ensuring that the systems used in a network are as secure as possible is at the core of having a secure corporate network. During the pen test, it is important to check the defense measures that are already being taken. This includes checking installed software such as operating systems, system services and ap­pli­ca­tions, which should always be up to date. If older versions are being used because they are com­pat­i­ble with other ap­pli­ca­tions, you need to take al­ter­na­tive pre­cau­tions to protect your system. In addition, access and au­then­ti­ca­tion re­quire­ments for in­di­vid­ual systems and programs play an important role. Here the pen test deals with issues such as:

• Access rights
• Password use and en­cryp­tion
• Use of existing in­ter­faces and open ports
• Defined rules (e.g., firewall rules)

Search for known vul­ner­a­bil­i­ties

It generally doesn’t take long to detect security vul­ner­a­bil­i­ties, which is why pen­e­tra­tion testers are generally familiar with the attack points of the test objects they are examining. With the in­for­ma­tion that the testers gathered on version status and patch level during their research on network component hardening, they can quickly identify which ap­pli­ca­tions pose a security risk. If many systems are to be analyzed in a short time, using vul­ner­a­bil­i­ty scanners can be helpful, although they don’t always provide an accurate result.

Targeted use of exploits

The tester can only work out whether the dis­cov­ered vul­ner­a­bil­i­ties can be exploited or not by actually ex­ploit­ing them. The command sequences used for such exploits are typically scripts obtained from different internet sources. These aren’t always securely pro­grammed though. If an unsecure exploit is carried out, there is a risk that the ap­pli­ca­tion or system being tested will crash and, in the worst case, important data may be over­writ­ten. This is why pen­e­tra­tion testers should be careful and only use reliable scripts from reputable sources, or refrain from testing the vul­ner­a­bil­i­ty al­to­geth­er.

What are the pros and cons of pen­e­tra­tion testing?

Ho­mo­ge­neous computer struc­tures are a thing of the past. Today’s de­cen­tral­ized IT struc­tures can cause new vul­ner­a­bil­i­ties and errors on a daily basis. While sometimes software creators can quickly fix these errors, it can sometimes take them a bit longer to remedy such issues.

This is where pen­e­tra­tion testing shows it strengths, providing the following ad­van­tages:

• Pen tests examine systems in much more detail than an ordinary security check.
• The basic goal of pen­e­tra­tion testing is to check how well in­di­vid­ual com­po­nents work together.
• With an external tester, you get an ad­di­tion­al opinion as well as a different view of your un­der­ly­ing security concept.
• Pro­fes­sion­al pen­e­tra­tion testers are specially trained and approach your system as a hacker would.

Pen­e­tra­tion testing, and col­lab­o­ra­tion with external testers in par­tic­u­lar, also comes with its own set of drawbacks though:

• While the pen test is being conducted, the testing team has access to internal in­for­ma­tion and processes.
• With pen­e­tra­tion tests, there is always the pos­si­bil­i­ty that the test can cause ir­repara­ble damage.
• Pen tests only provide snapshots of your network systems and as such, should never be used as a reason to forgo using common safety measures.

It’s also important to keep in mind that tra­di­tion­al pen tests don’t assess risks as­so­ci­at­ed with social en­gi­neer­ing. Many companies offer services to identify such vul­ner­a­bil­i­ties and provide special trainings on how to prevent social en­gi­neer­ing attacks as well.