Types of Penetration Techniques and Methods

Penetration testing is a critical technique used among managed services providers (MSPs) seeking to provide additional cybersecurity for their clients. By some estimates, a cyberattack is expected to happen every 14 seconds in the US—with total losses estimated to reach $21.5 billion. Penetration testing services can help an organization prepare for hacker attacks, malware, and more by continually and regularly checking for weaknesses, vulnerabilities, and bad user behavior on apps, services, and networks. Read on for a breakdown of penetration testing steps, services, what to expect, and penetration testing tools MSPs must know about this year.

What is penetration testing in cybersecurity?

Penetration testing is a way to “stress test” your IT infrastructure security. Penetration techniques are used to evaluate the safety and security of the network in a controlled manner. Operating systems, services, applications, and even the behavior of the end user is assessed to validate existing defense mechanisms and the efficacy of end-user security policies. 

There are a few reasons to regularly perform penetration tests (or “pen tests”). First and foremost, penetration testing can help ensure user data is secure, identify security vulnerabilities, discover loopholes in the system, and assess the overall strength of existing defense mechanisms. In addition, penetration testing can help a business stay up-to-date with each new software release. As threats evolve, financial and PI data must be secured iteratively—as new devices are added to a system, transferring data among different end points requires constant monitoring and assessment for security compliance.

Likewise, penetration testing has a few key benefits. It allows an MSP to proactively showcase their expertise and skillfully manage vulnerabilities. It saves money by allowing organizations to avoid network downtime. Penetration testing methods can help an MSP’s customers meet regulatory requirements and avoid fines. At the end of the day, it’s also an important tool to preserve an MSP’s image, reputation, and customer loyalty. 

Pen testing may sound similar to a vulnerability assessment, but the two cybersecurity measures are not the same. A vulnerability assessment focuses on identifying security issues within an organization. A list of vulnerabilities is produced from an evaluation of cybersecurity and data storage vulnerabilities. A penetration test, however, uses attack-simulated scenarios in a goal-oriented approach to cybersecurity. The test is designed to hit specific targets, such as a database, storage method, or designated file. The result of a pen test is not only a list, but a methodology and map of specific points of weakness. 

What are the types of penetration testing?

Industry experts generally divide penetration testing into three categories: black box testing, white box testing, and gray box testing. The categories correspond to different types of attacks or cybersecurity threats. 

Black box testing is concerned with a brute-force attack. In this scenario, the simulation is that of a hacker who does not know the complexity and structure of a company’s IT infrastructure. Therefore, the hacker will launch an all-out attack to try to identify and exploit a weakness. The penetration test does not give the tester any information about a web application, its source code, or any software architecture. The tester uses a “trial and error” approach to see where the vulnerabilities exist in the IT infrastructure. This type of penetration testing most closely mimics a real-world scenario, but it can take a long time to complete. 

White box penetration testing is the opposite of this first technique. In white box testing, the tester has full knowledge of the IT infrastructure, with access to the source code and software architecture of a web application. This gives them the ability to zero in on specific parts of the system and perform targeted component testing and analysis. It’s a faster method than black box testing. However, white box penetration testing uses more sophisticated pen testing tools, such as software code analyzers or debugging programs. 

Finally, gray box testing uses both manual and automated testing processes in a scenario in which the tester has partial knowledge of the internal IT infrastructure. The tester might receive the software code, for example, but not the system architecture details. Gray box penetration testing is a hybrid of white box and black box testing, allowing a user to utilize automated tools on the all-out assault while focusing their manual effort on locating “security holes.” 

These overarching types of penetration testing methods can be further subdivided into specific categories. Other types of penetration tests include: 

• Social engineering tests: The pen test scenario tries to get an employee or third party to reveal sensitive information, such as a password, business data, or other user data. This can be done through targeting help desks or sales representatives through the phone or internet. 
• Web application tests: The pen test uses software to assess the security vulnerability of web apps and software programs.
• Physical penetration tests: Mostly used in government sites or other secure facilities, the pen test tries to access physical network devices and access points in a mock security breach.
• Network services test: This is the most common pen test scenario, in which a user tries to either locally or remotely identify openings in the network. 
• Client-side test: This is when an MSP tries to exploit vulnerabilities in client-side software programs. 
• Wireless security test: The pen test identifies open, unauthorized, or low-security hotspots and WiFi networks and tries to infiltrate through them. 

All types of penetration testing should consider both internal and external components of an IT infrastructure. There are different phases of a penetration test that will ensure a holistic and regularly updated approach to an organization’s cybersecurity. 

What are the phases of a penetration test?

There are six generally accepted penetration testing steps. They are planning; reconnaissance and information gathering; scanning and discovery; attack and gaining access; maintaining access and penetration; and risk analysis and reporting. Depending on the frequency and type of penetration testing you wish to perform, these phases may vary slightly from MSP to MSP.

1) Planning for penetration testing 

The first phase of penetration testing involves determining the scope and goals of the test. MSPs must work with their clients to figure out the logistics, expectations, objectives, goals, and systems to be addressed. The planning phase will establish whether you are using a black box, white box, or gray box penetration testing method. 

2) Reconnaissance and information gathering

In this phase, the “hacker” or penetration tester seeks to discover as much information as possible about their target. They will gather information about end uses, systems, applications, and more. The information will be used to be precise in the penetration test, using a complete and detailed rundown of systems to understand what, exactly, needs to be addressed and evaluated. Some of the methods used during this phase may include search engine queries, domain name searches, internet footprinting, social engineering, and even looking up tax records to find personal information.

3) Scanning and discovery

The scanning and discovery phase is built to discover how the target system is going to respond to various attempts at intrusion. The penetration tester will most likely use automated penetration test tools to scan for initial vulnerabilities. Static analysis and dynamic analysis are two types of approaches used by the penetration tester. Static analysis inspects an application’s code in an attempt to predict how it will react to an incursion. Dynamic analysis looks at an application’s code as it runs, providing a real-time view of how it performs. Other aspects that a pen tester will discover include network systems, servers, and devices, as well as network hosts. 

4) Attack and gaining access

Once the pen tester has gained a complete understanding of the scope and components to be tested, they will attack in a simulated and controlled environment. Mimicking an actual cyberattack, the tester may take control of a device to extract data; perform a web application attack, such as cross-site scripting or SQL injection; or perform a physical attack, as mentioned previously. The goal of this phase is to see how far the tester can get into an IT environment without detection. The scope of the project should determine where the limits of the test should end to protect PI and other sensitive data. 

5) Maintaining access and penetration

Once a pen tester has successfully compromised their target, they should try to expand their access and maintain their presence for as long as possible. Again, the goal is to imitate a real-world bad actor as much as possible. The penetration tester in this phase will try to expand their permissions, find user data, and remain stealthy while running their programs deeper into the IT infrastructure. For example, the penetration tester may try to escalate their privileges to the role of administrator. The goal here is to remain undetected in the system for as long as possible and to try to get at the most sensitive data (according to the project scope and goals). 

6) Risk analysis and reporting

The last phase of penetration testing is the assessment and reporting phase. Once the penetration tester has been “discovered,” or the timeline for the project has been completed, a final report will be generated. The report should provide a summary of the testing, details of each step the pen tester took to infiltrate systems and processes, details of all vulnerabilities, how they cleaned up after the stress test, and suggestions for security fixes. A good penetration tester will also be able to determine the value of the compromised systems—i.e., how much financial impact would their incursion cost? To do this, a penetration tester uses some penetration testing tools. 

How long does a pen test take?

A penetration test can take between one and three weeks to perform. The time it takes to complete a penetration test depends on the type of test, the type and number of systems being evaluated, and the strength of your existing cybersecurity. It’s not a process that you should try to rush, since the point is to provide a thorough report of any vulnerabilities.  

How is penetration testing done?

Penetration testing tools can provide the feedback needed to complete the overall cybersecurity assessment. Pen test tools verify security loopholes by scanning data encryption techniques and testing logins and passwords. They resemble some of the tools a real hacker would use to try to infiltrate the system. Automated tools are useful in Black Box and Gray Box penetration testing. 

There are a few categories of penetration testing tools, including port scanners, vulnerability scanners, and application scanners. Port scanners work remotely to gather information and personal data about a target. Vulnerability scanners seek out known vulnerabilities in both network hosts and networks overall. Application scanners check for weaknesses in web-based applications. 

While it is possible to do your own penetration testing, this isn’t the most effective route to take as it’s time consuming, difficult to perform, and requires in-depth security skills and knowledge. But if you would like to use a penetration tool, there are some key characteristics to assess when selecting your software or program. 

When selecting a penetration tool, make sure the tool is easy to deploy and configure to your unique needs. The penetration tool should scan your system easily and be able to reverify any previous red flags. The tool should be able to categorize and rank vulnerabilities based on their severity, prioritizing for you what needs to be fixed immediately. There should be an automation aspect that verifies vulnerabilities for you, generating detailed logs. 

If you’re looking for further guidance, read through our resource center for other helpful information related to cybersecurity.

 

Additional Resources

• White Paper: The Cybersecurity Blueprint
• The Do's and Don'ts of DIY Penetration Testing
• 7 WAYS TO AVOID SECURITY BREACHES—Part 1, Consistency