Exploring the Role of Penetration Testing in Budget and Resource Allocation

What is Penetration Testing?

Penetration testing (or pen testing) is an authorised, simulated cyber-attack on a system or network-wide IT infrastructure. The aim of penetration testing is to uncover weaknesses in a security system before malicious actors can. Penetration tests can be broken down roughly into several steps:

• Initial reconnaissance. Security capabilities of a network or system are assessed, and analysis of a site or application codes are probed for potential responses.
• Analysis and planning. In light of this probing, penetration testers will determine what cyber-attacks are viable, and whether these intrusions can be maintained (a persistent malicious presence, for example, allows in-depth access and greater damage).
• Testing. Attacks will then be carried out by the penetration testers. The types of attack will depend on the insights of previous stages but can involve techniques such as harvesting data and escalating internal privileges.
• Remediation. These attacks provide a more precise picture of an organisation’s vulnerabilities. Penetration testers will then augment the efforts of an organisation’s security and IT teams and capacities, secure vulnerabilities, and if necessary, re-run the penetration testing process.

It is this last step – the remediation of vulnerabilities uncovered by the penetration testing process – that is so vital to budget and resource allocation. And as we’ll explore in the following section, contemporary penetration testing methods can provide more up-to-date guidance than those employed in the past.

How the Penetration Testing Narrative Has Changed

The cyber security landscape has evolved significantly over the past decade, and our approach to operating within it has had to evolve, too. When the National Cyber Security Centre was founded in 2016, guidance and attitudes around penetration testing were very different to what we see today.

A decade ago, penetration tests were often seen as an annual exercise – one where any highlighted gaps in an organisation’s cyber security posture were addressed over the following 12 months ahead of the next annual test. Although undoubtedly of value, these tests lacked the agility and deep insight to truly have an impact on an organisation’s wider cyber security policy.

Fast-forward to today, and we’re in a very different world. Zero-day attacks, new ransomware strains and ever more malicious malware have left us in a continual state of alert; a state in which we need to prioritise defending our organisations today while preparing for whatever fresh attack methods we must face tomorrow.

In this world, the annual penetration testing tick box exercise no longer cuts it. Different types of penetration test align to different cyber security postures and organisational priorities, but one thing is clear: penetration testing in 2022 forms a key pillar of any organisation’s cyber security posture, and if you get it right your penetration testing schedule will help you identify where you face the highest risk – and put in the budget and resource to address it before it can be exploited.

Who Are Penetration Testers?

Who are the people that carry out penetration testing? Aren’t they using the same methods that cybercriminals employ? Well, yes, they are. But they’re not being malicious when they do it. You may have heard the terms ethical hacker or white hat hacker, and these are the people who carry out penetration testing. Black hat hackers? Those are the bad guys.

All of the methods malicious black hat hackers use, penetration testers use as well. Phishing? Yep. Man-in-the-middle? Yep. Physically attending an organisation’s premises to try to gain access? Most certainly!

The difference is that whereas black hat hackers seek to find vulnerabilities and exploit them by launching ransomware and other cyber-attacks, penetration testers are searching for those same vulnerabilities but trying to help you identify and address them as quickly as possible.

So, who are penetration testers? They’re the good guys. Slightly edgy good guys with some sneaky tricks up their sleeves, but good guys nevertheless.

Types of Penetration Testing

Given the size and complexity of the infrastructures we operate today, there are a number of types of penetration testing that exist to stress test the security of different elements. Depending on an organisation’s needs, one or more of these types can be used.

Network Security

One of the most common types of penetration testing, network security penetration testing focuses on identifying the most exposed vulnerabilities and weaknesses in the network infrastructure of an organisation. This type of penetration testing has two subcategories — external network security and internal network security — each of which is part of a complete solution.

External network penetration testing works by mimicking an internet-based attacker and is focused on perimeter defence. Internal network penetration testing looks for weaknesses that could be exploited by a malicious internal attacker, or an external attacker who has already breached the network perimeter.

Web Security

This form of penetration testing is used to discover vulnerabilities and weaknesses in web-based applications. For this reason, it uses different techniques that attempt to break into the web application itself.

Mobile Applications

The growing use of mobile applications within organisations has given rise to a whole new category of mobile application penetration testing. The unique nature of mobile operating systems and the ways in which mobile apps interact with wider networks makes this a distinct type of penetration testing when compared to other types of web apps.

Wi-Fi Testing

Wi-Fi penetration testing identifies and examines the connections between all devices connected to an organisation’s Wi-Fi network. These devices can include laptops, tablets, smartphones, and any other connected devices. However, what makes this type of penetration test unique is the focus on the connection between these devices (the over-the-air part), and focuses on things like encryption, Wi-Fi settings, configuration and more to ensure a secure connection.

Social Engineering Attempts

With this form of penetration testing, a tester tries to persuade users into giving them sensitive information like usernames and passwords. This testing can include phishing attacks, vishing, and tailgating to impostors and eavesdropping.

Physical Testing

Physical security penetration testing simulates a real-world threat where a penetration tester attempts to compromise physical barriers to gain access to an organisation’s infrastructure, buildings, systems, or employees.w