A penetration test is an effective method of simulating a cyber attack on your organisation in the hopes of identifying vulnerabilities that can be exploited by malicious actors. These penetration testers are commonly referred to as ethical hackers, they perform reconnaissance where they carry out a lot of hands-on research on your organisation in the hopes of formulating an attack strategy. They then through the manipulation of current vulnerabilities gain and maintain access to your organisation's systems as an actual hacker would do. The result of a penetration test is an extremely detailed report on how your system can fix its vulnerabilities and strengthen its defences against cyber attacks.
If you are new to the topic, start with our overview of what a pen test is. This article focuses on how a test is actually carried out, step by step.
Penetration tests are usually described by how much the tester knows before they start and where they attack from:
A typical penetration test is carried out in the following six stages:
Every test starts with planning. The tester and your team agree the scope and goals: which systems are in and out of bounds, testing windows, contacts and the tools and techniques allowed. The tester then gathers intelligence on the target from public sources, such as websites, domain records and staff profiles, along with any information you have provided, to map likely weak points and plan the attack. How long this takes depends on the size of the organisation and the scope of the test.
Next, the tester uses automated tools and manual checks to probe the target for open ports and services, misconfigurations and known software vulnerabilities. This shows how the systems respond to intrusion attempts and where they are most exposed. Application testing typically combines two approaches:
Real attackers break in to steal, alter or delete data for financial gain or to damage a company’s reputation. At this stage the tester attempts the same, within the agreed rules, choosing the tools and techniques most likely to succeed: exploiting SQL injection or another application flaw, using weak or stolen credentials, deploying test malware or trying social engineering against staff.
Once inside, the tester tries to stay in the environment long enough to reach the test’s objectives, for example extracting sample data, changing it or misusing system functions, while moving towards higher-value systems. This demonstrates the real business impact a successful attack could have, rather than simply listing theoretical weaknesses.
As the final stage of the test itself, it consists of analysing the results. The ethical hacker or penetration testing team detail the entire penetration testing process in a report, describing the vulnerabilities that were exploited, the sensitive information that was accessed, what was implemented correctly, the duration of the attack, as well as possible remediation methods.
Once an organisation has implemented the remediations recommended in a penetration testing report it is a good choice to retest. A re-test can confirm that the reported vulnerabilities have been fixed.
In today’s world, organisations are increasingly becoming dependent, continuously digitising their business operations and processes. The number of technology risks associated with this development is also increasing, which has left businesses vulnerable to malicious actors. One way to identify any weaknesses in your systems and networks is to conduct penetration testing regularly. Without conducting a penetration test, your business is left to react to a security incident, which can mean significant risk. By adopting a proactive approach, and conducting annual penetration tests, your organisation can stay one step ahead of cybercriminals by finding and fixing exploitable vulnerabilities before attackers do. Penetration testing also helps your business comply with regulatory and compliance requirements, which if non-compliant, can open your business up to heavy fines or even the loss of the ability to accept card payments.
In Australia, for example, APRA-regulated entities must check that their information security controls work through a systematic testing program under CPS 234. Merchants and service providers covered by PCI DSS v4.0.1 need internal and external penetration tests every 12 months at a minimum, plus after any significant upgrade or change.
Handing someone permission, and sometimes sensitive information, to break into your networks and systems is a big decision, and a test can be costly to commission. Even well-intentioned testing carries some risk, because mistakes can occur during testing, and standards vary widely between providers. That is why it pays to choose a highly accredited penetration testing company. CREST accreditation is a well-established mark of quality for penetration testing.
StickmanCyber is accredited by CREST for penetration testing, and our testers detect the vulnerabilities in your business systems. Get a comprehensive report with actionable steps to improve the security of your data and business assets.
Get in touch with one of our expert consultants to get started today.
A written scope and rules of engagement, approved by someone with authority to authorise testing. They should list the systems, applications and IP ranges in and out of scope, testing dates and times, permitted techniques such as social engineering, emergency contacts and how sensitive data will be handled. NIST’s SP 800-115 testing guide includes a rules of engagement template.
A vulnerability scan is an automated check that lists known weaknesses, while a penetration test is a hands-on exercise in which a tester tries to exploit weaknesses to show what an attacker could actually achieve. The two complement each other: Under PCI DSS v4.0.1, for example, vulnerability scans are due every three months and penetration tests every 12 months, at a minimum.
There is no single law requiring every Australian business to run penetration tests, but some frameworks expect regular security testing. APRA-regulated entities must maintain a systematic program of testing their information security controls under CPS 234, which commonly includes penetration testing, and businesses that handle card data must meet the PCI DSS penetration testing requirements. Many organisations also test to support ISO 27001 or customer contract requirements.
It can, which is why planning matters. Running exploits or heavy scans can slow down or crash fragile systems, so experienced testers agree testing windows, avoid denial-of-service techniques unless they are explicitly approved, take extra care with production systems and keep an emergency contact on hand. Backing up critical systems before testing starts is also sensible.
Look for accredited, experienced testers, a clear methodology and sample reports, and check how the provider will protect your data and its findings. CREST accreditation is a widely recognised benchmark, and you can confirm a company’s accreditation on the CREST Marketplace. Our questions to ask your penetration testing vendor can help you compare providers.
A penetration test aims to find and exploit as many vulnerabilities as possible within an agreed scope and timeframe. A red team exercise is broader and more covert: a team emulates a real adversary pursuing a specific goal, often over several weeks, to test how well your people, processes and detection and response capability hold up. Red teaming usually suits organisations with a mature security program.