Penetration Testing
Penetration testing is an authorized security assessment in which testers attempt to breach some or all of a system's security, using the same tools and techniques an adversary might, to gain assurance in how secure the system is.
Updated
Overview
Testers mimic real-world attacks to find ways around the security features of an application, system, or network, often by issuing real attacks on real systems and data. Most tests look for combinations of vulnerabilities, on one system or several, that together give more access than a single vulnerability would. The result shows how vulnerable an organization's network is and how much damage a compromise could cause.
A test is authorized and planned in advance. In the planning phase, rules are identified, management approval is finalized and documented, and testing goals are set. Rules of engagement give the testers authorization for activities, such as attacks to compromise systems, that the organization's policies usually prohibit. Scoping sets the technical boundaries of the test, the types of test, and the timeframe. Testers may get full information about the target (open box testing) or none about its internals (closed box testing).
The NCSC treats penetration testing as a way to gain assurance in an organization's vulnerability assessment and management processes, not as the main way to find vulnerabilities, and compares it with a financial audit. The report should list the issues found, the risk each one poses, a way to resolve each, and advice on improving internal vulnerability assessment. Vulnerabilities the organization did not already know about deserve special attention, to work out how to spot such issues in future.
A test can only show that systems are not vulnerable to known issues on the day of the test, and a year or more often passes between tests. Because a test cannot be entirely procedural, its quality depends closely on the abilities of the testers.
Similar Terms
2 termsRed Teaming
A penetration test is typically used to identify the level of technical risk from software and hardware vulnerabilities. A red team assessment simulates real-world threat actors to assess how well an organization detects and responds to an attack.
Vulnerability Management
Vulnerability management is the organization's ongoing process for assessing and handling vulnerabilities. A penetration test is a periodic check that gives assurance in that process, much as a financial audit checks a finance team's day-to-day work.
Frequently Asked Questions
Do penetration testers need authorization?→
Yes. In the planning phase, management approval is finalized and documented, and rules of engagement authorize the testers to carry out activities, such as attacks to compromise systems, that the organization's policies usually prohibit.
What is the difference between a penetration test and a vulnerability scan?→
A vulnerability scan identifies hosts, their attributes, and likely vulnerabilities such as outdated software, missing patches, and misconfigurations. Penetration testing is a validation technique: it corroborates whether vulnerabilities exist and can be combined to gain more access.
What is the difference between open box and closed box penetration testing?→
In open box testing, full information about the target is shared with the testers. In closed box testing, no information about the internals of the target is shared, which more closely models attackers unaffiliated with the organization but can leave vulnerabilities undiscovered in the time allocated.
What should a penetration test report include?→
The report should include the security issues found, the testers' assessment of the risk each one poses, a method of resolving each issue, an opinion on the accuracy of the organization's vulnerability assessment, and advice on improving that process.
Related
Tool categories
Career roles
Sources
Definitions follow the government and standards body sources listed above. This site is not affiliated with the agencies or organizations cited.