- Get link
- X
- Other Apps
The pentesting or also known as penetration testing is a way to test vulnerabilities in the field of cyber security of an organization, company or organization, whether private or public. It is done from the perspective of a potential attacker and can include the active use of system vulnerabilities. technologywebdesign
Pentesting
The penetration testing (also known as pencil tests) allow
experts in cybersecurity (in this case, pentesters) identify vulnerabilities
and weaknesses in the security system that an attacker can use both virtual and
physical level.
Pentest content
Network penetration test :
1. Identification
of network and system level vulnerabilities
2. Identifying
incorrect settings and settings
3. Identification
of vulnerabilities in a wireless network
4. Fraudulent
services
5. Lack of
strong passwords and weak protocols
Application penetration test :
1. Identification
of deficiencies at the application level
2. Forgery
of applications
3. The use
of malicious scripts
4. Management
of interrupted sessions, etc.
Physical penetration test :
1. Piracy of
physical barriers
2. Checking
and breaking locks
3. Bypass
Sensors and Malfunctions
4. CCTV
cameras failure, etc.
Device Penetration Testing (IoT) :
1. Device
hardware and software defect identification
2. Brute
force weak passwords
3. Definition
of insecure protocols, APIs and communication channels
4. Configuration
violation and much more
Types of pentesting (penetration testing)
• Pentest
of "white box" (or white box) : in this penetration test, the
Pentester will be provided with information about the implemented security
structure of the organization. Additionally, this method can be implemented in
conjunction with the organization's IT team and the penetration testing team.
• Pentest
de "black box" (or "black box") : in this case, the actions
of a real attacker are simulated, since they do not provide any relevant
information to a specialist or team, except the name and the basic data for an
idea general work of the company.
• “Gray
box” (or “ gray box”) Pentest - In this situation, only a small portion of the
organization's employees (1 - 2 people), including IT and security
professionals who will respond to attacks, have no information over the
existing scan. For this type of test, it is very important that the pentester
or the team have the appropriate document to avoid problems with law
enforcement agencies, if the security service responds appropriately.
• External
Pentest : An attack by an "ethical" hacker that is carried out
against external servers or devices of the organization, such as its website
and network servers. The goal is to determine whether and to what extent an
attacker can penetrate the system remotely.
• Internal
Pentest - An authorized user with standard access rights performs a mock
attack, allowing you to determine what damage an employee who has some personal
accounts can cause with respect to management.
Stages of a
pentesting
• Collection
of information: in a search data about the organization and employees in open
sources, social networks, forums and blogs.
• Search
for a technical base : the definition of existing resources, applications and
technical means of a company.
• Vulnerability
and threat analysis : detection of vulnerabilities in security systems and
applications using a set of tools and wastes, both commercial and developed
directly at the Pentester company.
• Operation
and data processing : imitation of a real cyber attack to obtain information on
any vulnerability with a subsequent analysis.
• Generation
of reports : execution and presentation of the results of the pentest completed
with proposals to improve the security system .
The importance of performing a pentesting
The penetration tests show the true picture of the threat
existing security system and determines the vulnerability of the organization
to manual attacks. Performing a pentest on a regular basis will determine the
technical resources, infrastructure, physical and personnel arsenal that
contain weaknesses that require development and improvement.
In other words, for the same reason that you go to the
doctor for an annual health check, it makes sense to contact highly qualified
security consultants for a security test . Of course, you can say that you are
absolutely healthy, however, a specialist can perform tests to detect dangers
that even you cannot realize yourself.