This lesson covers the following:

• What is penetration testing?
• Why do penetration testing?
• What steps are involved in a penetration test?

What is penetration testing?

Penetration testing is the offensive testing of the implemented defenses from physical, digital, or social intrusion. Is is simply the method used to make sure intended protection mechanisms are functioning properly. Think of this like installing a home security system, then trying to break into the home to make sure the sensors detect the broken glass, or kicked-in door, and that the authorities are alerted in a timely fashion.

————————————————————————————————————–

Why do penetration testing?

Using the example above, how do you know if the security system works if it is not tested? The same is true for organizations that have confidential, regulated, or secret data that must be secured from prying eyes, destruction, unauthorized manipulation, and theft. There are several new mandates, standards, and regulations that are ensuring that organizations are testing their protection mechanisms. If testing is not proactive, just wait and see, the weaknesses in the protection mechanisms will be found and exploited. The penetration tester should be the first to find any weaknesses so corrective action can be taken, preventing loss.

————————————————————————————————————–

What steps are involved in a penetration test?

Penetration testing can be broken down into 7 high level steps. The depth of exploitation may be limited if the client has an issue with the methods and/or risks involved. This should all be agreed to and documented in the “rules of engagement” during the pre-engagement interaction. Let’s look a little closer at each of these steps.

1. Pre-Engagement Interactions
2. Intelligence Gathering
3. Threat Modeling
4. Vulnerability Analysis
5. Exploitation
6. Post Exploitation
7. Reporting