Penetration Testing.

What is penetration testing?

Penetration testing is a way of checking security by acting like an attacker. Testers try to get past the protections of a system, typically working under specific constraints. The aim is to find weak points that a real attacker could use.

NIST, the US standards body, gives several definitions in its glossary. One, from NIST SP 800-115, calls it security testing in which evaluators mimic real-world attacks to identify ways to circumvent the security features of an application, system, or network. Another says assessors, typically working under specific constraints, attempt to circumvent or defeat the security features of a system.

How does a penetration test work?

Methods differ, but they share a common shape. The OWASP Web Security Testing Guide lists several well-known methodologies. One of them, the Penetration Testing Execution Standard, splits a test into seven phases:

• Pre-engagement interactions
• Intelligence gathering
• Threat modeling
• Vulnerability analysis
• Exploitation
• Post exploitation
• Reporting

OWASP lists NIST 800-115 among the methodologies. Its listed areas include review techniques, target vulnerability validation, security assessment planning, security assessment execution and post-testing activities. OWASP also lists the Open Source Security Testing Methodology Manual, which covers areas beyond applications, such as physical locations, workflow, human security testing and wireless security testing.

NIST says its guide SP 800-115 helps organizations plan and conduct technical information security tests and examinations, analyze findings, and develop mitigation strategies. So a test does not end when the testers break in. The findings need to be analyzed and acted on.

What does a penetration test look like in simple terms?

This is a simple illustration only. An organization asks a testing team to try to get into one of its web applications. The team gathers information about the application, looks for weak points, and tries to use them under rules set in advance. At the end, the team writes a report of what it found so the organization can fix the problems.

How does it help reduce risk?

A test shows where defenses can be circumvented. NIST describes one form of testing as verifying the extent to which a system, device or process resists active attempts to compromise its security. The results can then feed into fixes. This sits next to vulnerability management, which is the wider habit of finding and fixing weaknesses.

OWASP says automated tools are good for breadth of coverage and repeatable checks, but they often lack the application-specific context needed to detect deeper flaws. It also says the most serious issues are frequently intertwined with business logic and custom design.

Is penetration testing the same as vulnerability analysis?

They are close but not identical. One NIST definition describes penetration testing as testing used in vulnerability analysis, trying to reveal vulnerabilities of the system based on information gathered about it. The testing part is the active attempt to get around security features.

Is a pen test the same as ethical hacking?

The sources we read do not define ethical hacking, so we treat it as a separate, informal term. “Pen test” and “pentest” are common short forms of penetration test.

Related terms

See also vulnerability management and social engineering.