A penetration test, and what it is not
A penetration test is somebody trying to get in, with permission and within an agreed frame. That is different from a scan listing known weaknesses. Both are useful; they answer different questions and cost a factor of ten apart.
The difference
Scan, test, and when each applies
They are used interchangeably and that leads to the wrong expectations.
- Vulnerability scanAutomated, fast and repeatable. Finds known vulnerabilities and missing updates. Should run periodically, because this is maintenance and not a project.
- Penetration testA person trying to actually use and combine the weaknesses found. Finds what a scanner cannot see: a flaw in the logic, a permissions problem, a chain of three small things.
- When each appliesYou scan continuously. You test when there is a new application, after a large change, or because a customer or a standard asks for it. Testing without scanning first is paying dearly for findings a scanner would have caught.
Settle beforehand
Four things that belong in the assignment
They decide what the test is worth and whether it runs safely.
- What is in scopeWhich systems, which addresses, which applications. What is not listed is not tested, and that is exactly what will be missing from the report.
- How much the tester knows upfrontFrom knowing nothing to being given an account and documentation. Knowing more yields more findings in the same time; knowing nothing shows how far an outsider gets. Choose deliberately.
- What is off limitsNo production outage, no real data taken away, no pressuring employees. Put it on paper, because otherwise it gets invented during the test.
- Who is told about itDoes your own operations team know? If not, you also test whether detection works. If so, you only test the technology. Either is a choice and not a detail.
What belongs with this
Testing is the check on everything built before it.
Know where it actually breaks
Tell us what has to be tested and why. You get a proposal with the scope, the approach and what will be in the report.
Practical IT knowledge in your inbox
New guides on management, security and the workplace, written by the people doing the work. No sales talk, and you can unsubscribe in one click.