A recent survey revealed that nearly 40% of people frequently worry about their personal information getting stolen by computer hackers. It’s no wonder: Cyber attacks and data breaches regularly make news headlines. How easily would criminals hack your website and steal sensitive information about you and your customers? Penetration testing could help you find out.
What is penetration testing?
A penetration test, a pen test, is a simulated cyber attack against your computer system to check for exploitable vulnerabilities. In web application security, penetration testing is commonly used to augment a web application firewall (WAF).
Pen testing can involve the attempted breaching of any number of application systems (e.g., application protocol interfaces (APIs), frontend/backend servers) to uncover vulnerabilities, such as unsanitized inputs that are susceptible to code injection attacks.
Insights provided by the penetration test can be used to fine-tune your WAF security policies and patch detected vulnerabilities.
Who Performs a Penetration Test?
Ethical hackers, known as pen testers, perform penetration tests. Some pen testers have formal training, while others are primarily self-taught. In either case, they may have certifications to back up their skills. Some examples include EC-Council’s Certified Ethical Hacker (CEH) or CompTIA’s PenTest+.
Penetration testing stages
The pen testing process can be broken down into five stages.
1. Planning and reconnaissance
The first stage involves:
- Defining the scope and goals of a test, including the systems to be addressed and the testing methods to be used.
- Gathering intelligence (e.g., network and domain names, mail server) to understand better how a target works and its potential vulnerabilities.
The next step is understanding how the target application will respond to various intrusion attempts. This is typically done using the following:
- Static analysis – Inspecting an application’s code to estimate how it behaves while running. These tools can scan the entirety of the code in a single pass.
- Dynamic analysis – Inspecting an application’s code in a running state. This is a more practical way of scanning, providing a real-time view of an application’s performance.
3. Gaining Access
This stage uses web application attacks, such as cross-site scripting, SQL injection and backdoors, to uncover a target’s vulnerabilities. Testers then try and exploit these vulnerabilities, typically by escalating privileges, stealing data, intercepting traffic, etc., to understand the damage they can cause.
4. Maintaining Access
This stage aims to see if the vulnerability can be used to achieve a persistent presence in the exploited system— long enough for a bad actor to gain in-depth Access. The idea is to imitate advanced persistent threats, which often remain in a system for months to steal an organization’s most sensitive data.
The results of the penetration test are then compiled into a report detailing the following:
- Specific vulnerabilities that were exploited
- Sensitive data that was accessed
- The amount of time the pen tester was able to remain in the system undetected
This information is analyzed by security personnel to help configure an enterprise’s WAF settings and other application security solutions to patch vulnerabilities and protect against future attacks.
Penetration testing methods
External penetration tests target a company’s assets visible on the internet, e.g., the web application itself, the company website, and email and domain name servers (DNS). The goal is to gain Access to and extract valuable data.
In an internal test, a tester with Access to an application behind its firewall simulates an attack by a malicious insider. This isn’t necessarily simulating a rogue employee. A common starting scenario can be an employee whose credentials were stolen due to a phishing attack.
In a blind test, a tester is only given the name of the enterprise that’s being targeted. This provides security personnel a real-time look into how an actual application assault would take place.
In a double-blind test, security personnel has no prior knowledge of the simulated attack. As in the real world, they will only have time to shore up their defenses after an attempted breach.
In this scenario, the tester and security personnel keep each other appraised of their movements. This valuable training exercise provides a security team with real-time feedback from a hacker’s point of view.
Penetration testing and web application firewalls
Penetration testing and WAFs are exclusive yet mutually beneficial security measures.
For many kinds of pen testing (except for blind and double-blind tests), the tester will likely use WAF data, such as logs, to locate and exploit an application’s weak spots.
In turn, WAF administrators can benefit from pen-testing data. After a test is completed, WAF configurations can be updated to secure against the weak spots discovered in the test.
Finally, pen testing satisfies some compliance requirements for security auditing procedures, including PCI DSS and SOC 2. Certain standards, such as PCI-DSS 6.6, can only be met through a certified WAF. However, doing so doesn’t make pen testing any less useful due to its benefits, as mentioned above and its ability to improve WAF configurations.
How Vulnerable is Your Website?
Many websites are vulnerable to hackers. Sites that run on content management system platforms like Drupal or WordPress tend to be targeted more often. That’s partly because they’re so prevalent but also because their code is publicly accessible. And if you’ve customized your website with third-party plugins or themes, some of those add-ons could have security flaws.
Does My Website Need a Penetration Test?
After learning about pen testing, you may wonder: Does my business need a penetration test? In some cases, pen testing may be mandatory to comply with privacy laws and regulations. But even if pen testing isn’t a legal requirement for your business, you may choose to do it to help protect your customers’ private information.
Protect Your Business With Penetration Testing
It’s time to uncover potential weak spots in your company’s website. We make it easy — Find the perfect pen tester today.