What is Penetration Testing, and How Does It Work?

In 2021, a new organization was targeted by ransomware every 11 seconds. In addition, 18% of companies said that cybersecurity risks will have the biggest impact on their growth through 2024, and there are now three times more networked devices on Earth than humans. Knowing this, wouldn’t it be nice to have hackers on your good side?

Penetration testing gives you exactly that. Let’s explore how in more detail.

What is Penetration Testing?

Penetration testing is a one-time security exercise that tests the resilience of your application or network. It involves a team of white hat or ethical hackers who are hired to break into your application and find security vulnerabilities to exploit.

In this way, they do exactly what the bad actors would do when trying to access your application, except, penetration testers are ethical hackers. That means they’re ready to alert and inform you of vulnerabilities immediately. In some cases, pen testing providers may also offer you security remediation advice.

Penetration Testing as a Service (PTaaS) is an extended, more comprehensive form of pen testing that provides year-round coverage. Whereas a one-time pen test is great for providing a baseline of your security posture, PTaaS will test your application multiple times per year, plus provide security consulting and fix verification testing throughout the year as well.

Who Performs Penetration Tests?

Pen tests are performed by penetration testers (or pen testers, for short). Pen testers are expert security engineers who understand risks such as those detailed in the OWASP Top 10. Using a combination of manual and automated testing, they can creatively apply their unique areas of expertise to locate known vulnerabilities and often even exploit new issues.

Depending on their background, penetration testers may have various areas of expertise. For example, they may be proficient at finding one type of vulnerability (such as XSS), or may excel at certain types of penetration tests (such as mobile pen tests).

The Difference Between Penetration Tests and Vulnerability Scans

Vulnerability scanning and automated tools are very different from pen testing. Together, all have a place in a healthy security posture.

Vulnerability scanning tools, such as SAST, DAST, IAST and RAST, are quite common for organizations that want to quickly scale their security testing on the cheap. However, these tools aren’t able to dive as deep into code and can often miss critical vulnerabilities. As such, using only vulnerability scanning tools may actually be giving your organization a bit of security theater.

Types of Penetration Tests

Today, penetration testing essentially comes in two forms: baseline penetration testing and penetration testing as a service (PTaaS).

Baseline Penetration Testing

Baseline pen testing is better suited for clients that need a one-time check on their security. Best cases for getting a baseline pen test include:

• A small start-up who doesn’t have the budget for more security coverage
• A company earning compliance for the first time who needs a security assessment done as part of the compliance requirements
• A company involved in an M&A deal who wants to use security as a measure to help valuate a company
• A B2B company closing enterprise deals, who may be completing many vendor security questionnaires

Penetration Testing as a Service (PTaaS)

PTaaS is a more comprehensive approach to security testing, as it integrates security as part of the SDLC. As code is deployed, it is continuously tested to ensure a higher level of application security year-round. In addition, it includes consulting, more re-testing, and better access to security expertise for development teams.

Best cases for getting PTaaS include:

• A company who wants to increase the performance and value of their application through security
• A company who wants to integrate security as a part of the Dev/DevOps pipeline
• A company who wants to streamline security processes across multiple projects or applications

Penetration Testing Stages

There are seven key stages in an effective pen test:

1. Reconnaissance

This stage is all about understanding the application and its unique business logic. Meetings with the client and pen test provider help ensure that all parties are well-informed about the test. The test environment must be ready at this point.

2. Threat Modeling & Custom Security Plan

Building out a threat model is essential to understand the common use cases of the application. An effective threat model can also identify security risks in the design of the application, which may be difficult to change at a later stage. But understanding these risks early helps prepare the rest of the security plan to work around them.

3. Automatic & Custom Script Developments

The fun begins. Pen testers start diving deep into the application with a mix of manual and automated approaches.

4. Identification of Zero-day Vulnerabilities

As critical vulnerabilities are identified, the client is notified immediately. Steps to reproduce the issue are shared with the client so that their development team can begin remediation as soon as possible.

5. Exploitation and Escalation

The less severe vulnerabilities found during the early stages of the pen test are exploited and escalated as much as possible without affecting the function of the application (for instance, if a pen tester is testing a vulnerability and it risks taking down the entire application, they’ll take it as far as possible without creating any actual harm). Test environments and test accounts are created to prevent any real damage and exploitation to the live application.

6. Cleanup and Reporting

Upon completion, pen testers will gather all found issues, regardless of severity, into a report. A good penetration testing provider should also include steps for replicating the issue so that the client’s development team can mitigate the issue.

7. Retesting and Certification

After the report is delivered, the client may patch several vulnerabilities. A quality pen test provider will be able to retest these known vulnerabilities shortly after to verify that they have been fixed correctly or sufficiently. In some cases, the pen tester may require that the client develops a complete fix, and in other cases a “band-aid” solution may suffice for critical issues that need deeper attention later.

When all is good to go, the pen test provider can offer a certificate to the client as proof of application security. This certification is essential when earning compliance such as SOC 2 or ISO 27500. It’s also helpful for closing enterprise deals (learn more about vendor security questionnaires here) or for startups that want to generate higher investor appeal.

Penetration Testing Methods

We can now go over the two testing methods available. These include the following:

Manual

Manual penetration testing is when it is done by human hackers. This method needs to be handled by qualified security engineers, or pen testers, as described in the above sections.

Due to the time and effort involved in manual testing, this takes the longest and can be the most expensive of the two methods. However, with a highly qualified security engineer, this can also be the most thorough and deepest penetration test. This is especially true if you are eager to find new types of vulnerabilities or are willing to share some of your source code with your pen tester, you are better off to go with this option.

Automated

In contrast to manual testing, automated testing is the use of software tools to conduct the pen test. It is easier to scale, more affordable, and can be applied to multiple projects for less cost. So, from an economical standpoint, this is the better option.

However, automated testing may miss more critical vulnerabilities and cannot dive as deeply into your application logic as manual testing can. Thus, it is best to combine automated testing with manual testing or some other manual security exercises, such as threat modeling or secure code review.