PENETRATION / PENETRATION TEST: WHAT IS IT?

In penetration tests, attempts are made to infiltrate and compromise an organization's information infrastructure using methods as they were conducted by cyber criminals. Security professionals conducting penetration tests, also known as pentesters, simulate intrusion and hacking scenarios, thinking like hackers. By applying and testing various methods attackers might use, they aim to identify and fix vulnerabilities in the system when confronted with a real attack. Licensed or open source tools are used in penetration tests, combining automateed scanning tools with custom manual tests tailored to the organization’s needs to detect and address vulnerabilities as comprehensively as possible.

Objectives of penetration tests include:

Testing and auditing the effectiveness of the organization's security policies and controls.

Conducting in-depth, internal and external vulnerability and exposure scans.

Providing usable data to audit teams collecting data for compliance with standards.

Offering a comprehensive and detailed analysis of the organization's security capacity to reduce the cost of security audits.

Systematically applying patches for known vulnerabilities.

Finding out existing risks and threats in the organization's network and systems.

Evaluating the effectiveness of network security devices such as firewalls, routers, and web servers.

Providing a comprehensive plan identifying actions to prevent future attack, infiltration, and exploitation attempts.

Determining whether the current software, hardware, or network infrastructure needs any changes or upgrades.

Before conducting a penetration test, it is essential for the organization to perform a risk assessment to identify potential threats the network may face.

Systems that should be considered for risk assessment:

Communication and e-commerce services, systems handling the transmission and storage of sensitive information.

Websittes, email servers, remote access platforms.

DNS firewall, passwords, FTP, IIS, and web servers.

Critical production systems.

Systems owned by customers.

Penetration Test Methodology

The Penetration Testing Execution Standard (PTES), established in 2010, outlines penetration testing in seven main stages:

Pre-engagement Interactions: Discussing methods and tools to be used in the test, defining scope, estimated completion time, what will be tested, and providing additional support for items not covered in the scope.

Intelligence Gathering: Collecting information about the organization to create a strategic attack plan.

Threat Modeling: Identifying and categorizing assets, creating a threat model focusing on the organization's assets and potential attackers through categorization.

Vulnerabilityy Analysis: Identifying system and application vulnerabilities that may be exploited by attackers.

Exploitation: Bypassing security restrictions to find the main entry point and identify high value assets.

Post Exploitation: Determiningthe value of information on the compromised machine and maintaining control for use on other targets in the network.

Reporting: The report should include technical details of the test, agreed upon assets and components, scope, information, attak techniques, methods used, impact, risk level, and improvement recommendations.

Penetration Test Methods

Blackbox: The penetration tester is not provided with any information about the structure or system where the test will take place.

Whitebox: The penetration tester is provided with information about all structures and systems within the organization.

Graybox: A penetration test method that falls between 'Whitebox' and 'Blackbox.' The penetration tester is not provided with detailed information about structures and systems.

Types of Penetration Tests

Web Application Penetration Test

Network Penetration Test