- Vulnerability testing merely probes
systems for vulnerabilities.
Those tests can be active,
reaching out and interacting with systems,
but they are rarely dangerous
because they don't typically complete an attack.
Actually, executing an attack is,
however, the best way to understand
the system's vulnerabilities.
Penetration test do this by placing testers
in the role of attackers.
During a penetration test attackers normally begin
by gathering information about systems,
and then using that information to engage in actual attacks.
The test is considered successful
if the attackers managed to penetrate the target system.
The goal is to test security controls
by attempting to bypass or defeat them.
The National Institute for Standards and Technology,
NIST, suggest that penetration tests loop back and forth
between a discovery phase and an attack phase.
During the discovery phase attackers
conduct reconnaissance against systems
and think of possible avenues of exploit.
When they find a path of potential vulnerability,
they move into the attack phase
where they seek to gain access to the target system,
escalate that access to advanced privileges,
and then browse through the network
looking for new systems they can access
from that vantage point.
They may also install additional
penetration testing tools on compromised systems
in an effort to gain even deeper access to the network.
For example, if penetration testers exploit a vulnerability
to gain access to an application server,
they might then install tools on that application server
to attempt to gain privileges on the database server
supporting that application.
There are three types of penetration tests,
and they differ in the depth of knowledge
that the attackers have prior to each test.
In a white box test, the attacker has full knowledge
of the network environment.
It's the equivalent of simulating an insider attack.
In a black box test, the attacker has no prior knowledge
of the enterprise IT environment,
and seeks to gain that knowledge
as they move through the attack in discovery phases.
This is equivalent to simulating an external attack.
Gray box attacks fall in the middle,
and the attacker has some knowledge of the system.
This approach is commonly used
because it combines some of the
external perspective benefits of a black box test
with the time saving nature of a white box test.
Penetration tests are labor intensive for internal staff,
and expensive when using external consultants.
For this reason, they're not done frequently,
but they do provide valuable insight
into the security of a system.
Therefore, penetration tests should be
an occasional part of the security professionals test kit.