Blog

Penetration testing is a service where your external and internal resources are tested for security flaws. By assessing your external and internal risk, your organization can quickly identify remediation steps and any areas for improvement. A penetration test can be completed multiple ways but requires qualified expertise with accessible resources to be beneficial. Below, we’ll evaluate penetration testing criteria through assessing resourcing and methodology, while also seeing the different types of services and associated costs.

Steps to conducting a Penetration Test

The penetration test will generally follow the high-level steps below. The thoroughness of the testing will vary according to the skills of the tester, but the overall methodology should look the same.

1 Information Gathering

• Identify restricted hosts (i.e., systems and devices not to be tested)

• Perform reconnaissance on target infrastructure via social media (e.g., LinkedIn, Facebook)

• Execute user enumeration to identify valid user accounts

• Conduct Google Hacking to identify potentially exposed infrastructure

• Harvest compromised password databases to assist with password profiling and password reuse attacks

2 Discovery and Vulnerability Scanning

2.1 Infrastructure Security Testing

• Perform comprehensive port scanning, fingerprinting of services and applications

• Use automated scanning tools & technologies to identify publicly known operating system and application vulnerabilities (Network-based or Authenticated Scans)

• Manual validation of findings, removing false-positive items and low-confidence findings where applicable

• Manual vulnerability testing using commercial and/or custom tools

2.2 Application Security Testing

• Comprehensive mapping & manual crawling of the web applications to ensure coverage

• Automated discovery of vulnerabilities using various commercial grade tools

• Manual validation of automated security testing results

• Manual testing for hard to find vulnerabilities including but not limited to: business logic, session handling, file upload functions, race conditions, hash-length extension, bit flipping attacks and authorization flaws

• Comprehensive coverage of PCI-DSS 6.5, OWASP Top 10:2017 and Sans Top 25.

3 Application and Network Layer Penetration Testing

• Exploit vulnerabilities on affected hosts utilizing penetration-testing tools and manual testing techniques

• Attempt to escalate privileges and/or gain unauthorized access

• Attempt to pivot from compromised systems to other internal systems

Choosing a Penetration Testing service

Depending on the purpose of the penetration testing (compliance or for customer confidence), you may choose to complete testing in-house or utilize an external third party. If you depend on in-house skills, you should ensure the tester holds equal or higher qualifications than the external third party to ensure no risks are missed.

If you choose a third-party, you should validate their qualifications to ensure you’re receiving the most value for your investment.

Types of Penetration Tests

There are three different types of penetration tests offered. Each vary in information provided by the organization to the tester. With more information offered, less time is required for the tester which results in lower costs.

• Black box – no access to any information about the environment

• Grey box – high level information provided

• White box – complete open access to the environment

For more information on the three types, please read our Black-Box vs Grey-Box vs White-Box Penetration Testing article.

Cost of a Penetration Test

The cost of a penetration test can differ dramatically depending on the type chosen, the scope (e.g., how many assets are being tested), and the methodology (the thoroughness of the testing). In total, there are 7 factors that affect the cost of a penetration test. If you’re looking for a quote, reach out to a prospective third-party penetration testing company and provide them with the following details:

• Number of assets (IPs) to be tested (internal and external depending on requirements)

• Number of web applications and their corresponding page account. Providing a demo account is usually enough for a vendor to login and assess requirements. If you can’t provide a demo, screenshots will also suffice

• The number of roles for the web application. If you have an admin role and a user role, that would be two roles

We hope the information above educated you in the penetration testing process. If you have any additional questions, you can visit our Penetration Testing frequently asked questions blog, or book a meeting with us to learn more about how we can help.