Unlike a vulnerability assessment, in which a tool scans the environment to determine possible vulnerabilities in operating systems and applications, the pentest goes further. It has a qualified professional with similar knowledge and skills as a real attacker, who uses the same techniques and tools to identify and exploit security vulnerabilities and find out what kind of damage could be caused by an actual attack.

This penetration testing professional must have the ability to think “out of the box” and use their creativity to identify the various possibilities exploitation of a corporate network.

What are the main categories of a penetration test?

Black Box – In this type, the professional contracted for the penetration test does not have any information about the network that will be analyzed, it is the approach that happens when a real attack occurs. The attacker develops research and then identifies the best way to compromise the network.

Gray Box – Here the professional pentester receives some basic information about the environment to be tested, this information can include a valid IP address or user credential for the environment, very useful to identify what type of attack could be carried out by an internal user or employee the company.

White Box – In this scenario, the test is conducted by a contracted professional who receives all the pertinent information for the network to be analyzed, including network topologies and IP addresses of computers. It is a useful method to identify what type of attack could be carried out by a user with administrative rights and to determine the faults in any isolated internet networks, but which can still be compromised in other ways, such as using a USB stick malicious content on a workstation.

What are the benefits of pentesting to my company?

The practice of regular penetration tests is mandatory for some security standards (such as PCI-DSS) and creates many advantages for your company, including:

1. Test your environments and defenses against attacks by a qualified professional who knows the same methodologies and tools used by real attackers;
2. Identify what types of data can be stolen from your company;
3. Identify the risks to the business and, consequently, to the reputation of your brand, avoiding financial damages that go beyond the loss of data;
4. Validate your security and compliance policies and ensure that they are adequate to ensure network and asset security;
5. To plan investments in Information Security more effectively with a penetration test it is possible to discover that a smaller investment in a specific tool or process may be more useful for improving the security of information in the company than the acquisition of that equipment that costs $1 million that you were planning to buy.

An impressive ROI, right? Have you already tested to see if your company is protected against attackers and cyber threats?

Red Team vs Blue Team Exercises

Another method that is part of ethical hacking is the “Red Team versus Blue Team.” In this service, a team of attackers (the red team) attempts to attack the company to test the effectiveness of the company’s Security Operation Center (the so-called blue team) in response to the attack. The methodologies, tools, and tactics used by the red team are, in general, like the Black Box.

The result in any of the methods used is the issuance of a detailed report describing the types of vulnerabilities that were successfully exploited in the intrusion test, which data could be accessed, the servers and workstations that were compromised, in addition to possible damage which could have been caused by a real attack. The report considers the criticality of each of the flaws about the business processes and business continuity and, depending on the contracted scope, includes a patch management plan for the vulnerabilities encountered.