What is a pen­et­ra­tion test (pen test)?

With pen­et­ra­tion tests (often referred to as pen tests), it’s possible to determine the like­li­hood of an attack on your network, including in­di­vidu­al systems within the network as well as specific ap­plic­a­tions. Find out how such tests are conducted and what they mean for a network that is already in use.

What is pen­et­ra­tion testing?

In the IT sector, a pen­et­ra­tion test is a planned attack on a network of any size or in­di­vidu­al computers that aims to uncover vul­ner­ab­il­it­ies. To achieve this, various tools are used to simulate different attack patterns, which are modelled around common attack methods. Typical com­pon­ents that undergo a pen test are:

• Network coupling elements such as routers, switches and gateways
• Security gateways such as software and hardware firewalls, packet filters, virus scanners, load balancers, IDS and IPS etc.
• Servers such as web servers, database servers, file servers etc.
• Tele­com­mu­nic­a­tion systems
• All types of web ap­plic­a­tions
• In­fra­struc­ture in­stall­a­tions e.g. control access mech­an­isms
• Wireless networks that are part of the system such as WiFi or Bluetooth

Testing is normally divided into black box, white box and grey box testing: with black box testing, pen­et­ra­tion testers are only given in­form­a­tion about the address of the target network or system. With white box testing, the testers have extensive knowledge of the systems they are going to test. In addition to the IP address, they also receive in­form­a­tion about the software and hardware com­pon­ents being used. Gray box testing, which is the most common form of pen­et­ra­tion testing, combines black box and white box testing methods. Basic in­form­a­tion about the IT in­fra­struc­ture is made available, such as what the systems are used for and their general makeup.

What do I need for a pen test?

How can you create a custom pen­et­ra­tion test for your own network? Below you’ll find essential in­form­a­tion about what you need to consider when con­duct­ing a pen­et­ra­tion test.

How can I prepare for a pen test?

To suc­cess­fully conduct a pen test, it’s important to first establish a clear plan. Identify which com­pon­ents need to be tested, whether you have all the necessary tools on hand and the timeframe for each in­di­vidu­al test as well as for the overall as­sess­ment of your network.

The pre­par­a­tion phase is even more critical if you’re hiring external testers, and you want to use the white box testing method. If this is the method you want to use, you’ll need to provide the testing team with all the in­form­a­tion about your network and its systems as well as with the doc­u­ment­a­tion you have for your system. For a black box test, the process is different. With this method, you’ll only need to disclose the target addresses of the com­pon­ents that should be tested.

What are the best tools for pen­et­ra­tion testing?

Since there are so many different kinds of attacks, it makes sense to have lots of different tools available for pen­et­ra­tion testing. Some of the most important ones are:

• Port scanners: port scanners use spe­cial­ised tools to identify open ports in a system.
• Vul­ner­ab­il­ity scanners: vul­ner­ab­il­ity scanners examine systems to check for existing security vul­ner­ab­il­it­ies, faulty con­fig­ur­a­tions and in­ad­equate password and user policies.
• Sniffers: a sniffer is used to analyse network traffic. The stronger the en­cryp­tion, the less in­form­a­tion it will be able to gather.
• Packet gen­er­at­ors: packet gen­er­at­ors are tools used to generate or simulate network traffic data. This makes it possible to mimic network traffic during a pen­et­ra­tion test.
• Password crackers: pen testers use password crackers as a way to obtain passwords that aren’t secure.

Many of the tools listed above have been ex­pli­citly developed for network security tests and as a result, are tailored to specific test areas. While the vast majority of these programs come from the open-source sector, there are some com­mer­cial security ap­plic­a­tions, which are generally better doc­u­mented and come with com­pre­hens­ive IT support.

What are the different steps of a pen­et­ra­tion test?

The test procedure for a pen test can be divided into the following four steps:

Review network concept

A pen­et­ra­tion test can reveal in­con­sist­en­cies or weak­nesses in the design of a network or in in­di­vidu­al com­pon­ents as early as the pre­par­a­tion stage. For example, if multiple ap­plic­a­tions are con­figured with different access groups, they can quickly create com­plic­a­tions and present a security risk for the entire network, even if the network and in­di­vidu­al hosted programs are ad­equately protected. Some of these cases can already be resolved during a pre­lim­in­ary dis­cus­sion, while others can only be confirmed by carrying out a practical test.

Test hardening measures

Ensuring that the systems used in a network are as secure as possible is at the core of having a secure corporate network. During the pen test, it is important to check the defence measures that are already being taken. This includes checking installed software such as operating systems, system services and ap­plic­a­tions, which should always be up to date. If older versions are being used because they are com­pat­ible with other ap­plic­a­tions, you need to take al­tern­at­ive pre­cau­tions to protect your system. In addition, access and au­then­tic­a­tion re­quire­ments for in­di­vidu­al systems and programs play an important role. Here the pen test deals with issues such as:

• Access rights
• Password use and en­cryp­tion
• Use of existing in­ter­faces and open ports
• Defined rules (e.g. firewall rules)

Search for known vul­ner­ab­il­it­ies

It generally doesn’t take long to detect security vul­ner­ab­il­it­ies, which is why pen­et­ra­tion testers are generally familiar with the attack points of the test objects they are examining. With the in­form­a­tion that the testers gathered on version status and patch level during their research on network component hardening, they can quickly identify which ap­plic­a­tions pose a security risk. If many systems are to be analysed in a short time, using vul­ner­ab­il­ity scanners can be helpful, although they don’t always provide an accurate result.

Targeted use of exploits

The tester can only work out whether the dis­covered vul­ner­ab­il­it­ies can be exploited or not by actually ex­ploit­ing them. The command sequences used for such exploits are typically scripts obtained from different internet sources. These aren’t always securely pro­grammed though. If an unsecure exploit is carried out, there is a risk that the ap­plic­a­tion or system being tested will crash and, in the worst case, important data may be over­writ­ten. This is why pen­et­ra­tion testers should be careful and only use reliable scripts from reputable sources, or refrain from testing the vul­ner­ab­il­ity al­to­geth­er.

What are the pros and cons of pen­et­ra­tion testing?

Ho­mo­gen­eous computer struc­tures are a thing of the past. Today’s de­cent­ral­ised IT struc­tures can cause new vul­ner­ab­il­it­ies and errors on a daily basis. While sometimes software creators can quickly fix these errors, it can sometimes take them a bit longer to remedy such issues.

This is where pen­et­ra­tion testing shows it strengths, providing the following ad­vant­ages:

• Pen tests examine systems in much more detail than an ordinary security check.
• The basic goal of pen­et­ra­tion testing is to check how well in­di­vidu­al com­pon­ents work together.
• With an external tester, you get an ad­di­tion­al opinion as well as a different view of your un­der­ly­ing security concept.
• Pro­fes­sion­al pen­et­ra­tion testers are specially trained and approach your system as a hacker would.

Pen­et­ra­tion testing, and col­lab­or­a­tion with external testers in par­tic­u­lar, also comes with its own set of drawbacks though:

• While the pen test is being conducted, the testing team has access to internal in­form­a­tion and processes.
• With pen­et­ra­tion tests, there is always the pos­sib­il­ity that the test can cause ir­re­par­able damage.
• Pen tests only provide snapshots of your network systems and as such, should never be used as a reason to forgo using common safety measures.

It’s also important to keep in mind that tra­di­tion­al pen tests don’t assess risks as­so­ci­ated with social en­gin­eer­ing. Many companies offer services to identify such vul­ner­ab­il­it­ies and provide special trainings on how to prevent social en­gin­eer­ing attacks as well.