Penetration Testing, also known as "pentesting", is an elementary part of the IT security strategy of companies, organizations and governments. But what is a penetration test? Experienced ethical hackers (i.e. the "good" hackers) explain in this article how pentesting works and how it helps those responsible to protect their systems from cyber attacks.
A penetration test (Pentest for short) is a controlled attack on an IT system from the perspective of an attacker in order to uncover security gaps. Vulnerabilities found are exploited and combined to check what damage malicious attackers could cause. The result of a penetration test is a report that documents all vulnerabilities found, classifies them according to criticality and provides measures for resolving them.
This is what the result of a pentest can look like in the form of a report with prioritization and measures: Action Plan Demo
Pentesters differ from malicious hackers in three main ways:
Let's imagine a game of chess - or any other strategy game. Before making his next move, a player analyses his current situation and weighs up his options. In doing so, the player must take into account what action his opponent can take afterwards. After some consideration, he is sure that he has found the best option for himself and makes his move. Then it is the opponent's turn - and the player realises that he has overlooked a trap and is now checkmated.
How much easier would it have been for the player if he had been able to use a test opponent before his real move to show him what effects his action could have?
In a game, the use of a test opponent would be considered an unfair advantage that is not allowed. In the fight against hackers, however, companies can and should gain this advantage - with a penetration test.
A penetration test gives companies, organizations and governments a strategic advantage in protecting themselves from malicious hackers: They do not have to rely on their internal view of their own security. Penetration testers play the role of attackers for them and find out which security gaps they can use and how far they can penetrate. They then support the company's IT team in gradually closing these gaps so that hackers no longer have any opportunities to attack.
Many managers think that IT security is one of the core tasks of their own IT team or an external provider. They feel particularly safe when IT is completely outsourced. The truth is: the company management (board of directors or managing director) is ALWAYS responsible for IT security. They can delegate tasks in this context, but not responsibility.
This responsibility for information security is defined by various laws and regulations. For example, the legality obligation stipulates that managing directors must observe all applicable legal regulations. This also includes the IT Security Act 2.0 and the NIS2 Directive from the time it comes into force.
Is it enough for the managing director to tell his IT team "Make sure we are secure!"? Or if he assumes that everything is secure when using an IT service provider? No, because IT specialists are not automatically IT security specialists; the situation is similar to that of general practitioners and specialists.
Company management can only fulfil its legal obligations in terms of IT security if it either employs proven experts in this field in its own team or calls in appropriate external service providers.
Companies need to optimize their IT security not only for their own benefit, but also to meet legal requirements or obtain certain certifications. The most important requirements include:
These laws and certificates not only help make IT systems more secure, but are also crucial to avoid penalties and fines.
The idea of different types of pentests is basically based on misconceptions about this service. The truth is that at its core, every pentest has the same goal and the same strategy: Every pentest simulates attacks on an IT infrastructure in order to obtain the most comprehensive picture of security possible and to uncover vulnerabilities.
Differences in penetration testing mainly relate to
Possible combinable variants of penetration tests are:
The level of realism of a penetration test determines how close the test is to a real attack scenario. Note: "The more realistic, the better" does not necessarily apply! Tools such as a pentest box can be useful for obtaining the broadest possible overview of your own security in a time- and cost-efficient manner. Passing on internal company information beforehand can also be important to avoid damage to particularly sensitive systems through a pentest.
A penetration test is a project that runs in several successive phases. Each individual phase is important in order to obtain the most comprehensive picture of IT security possible, while at the same time avoiding causing any real damage.
Penetration testers work in the same way as malicious attackers. This means that they use existing frameworks and tools, but also develop their own approaches when necessary. Unlike malicious hackers, they always have to make sure that they do not cause any real damage. To do this, they need extensive expertise and the creativity needed to skillfully combine different approaches.
These are some of the most common tools and procedures for penetration testing:
The right time for a penetration test is: Now. (If the last penetration test was more than 12 months ago.)
As a service provider in the field of penetration testing, we often experience that customers see the need for a pentest and would like to commission it, but would like to postpone the start of the project several months into the future.
The usual reasons for postponing penetration testing are:
The point is: hackers don't care about any of these things. They attack even if the vulnerability is supposed to be closed in two weeks or if an important deadline is approaching.
Good reasons for conducting a pentest promptly are:
When choosing the right pentest provider, three aspects are crucial:
How can you find out if these points apply to a provider?
A penetration test is a controlled attack on an IT system to identify security vulnerabilities before real attackers exploit them.
A pentest uncovers vulnerabilities, improves IT security and helps meet legal compliance requirements.
In a black box pentest, the tester has no internal information, while in a white box pentest, the tester has full access to system information.
Networks, web applications, mobile apps, physical security and human vulnerabilities are examined for security vulnerabilities.
Ideally annually or after major IT changes.
A pentest simulates real attacks and exploits vulnerabilities, while a vulnerability scan lists known vulnerabilities.
Regulations such as ISO 27001, IT Security Act 2.0 and NIS2 require regular security checks such as pentests.
