PENETRATION TESTPenetration Testing

What is Penetration Testing?

Penetration testing is used to assess the security of IT application and infrastructure. It is the process of identifying security vulnerabilities within an application by evaluating the system or network using various cyber-attacks. Vulnerabilities in a system or application are identified through a process of authorized simulation attacks against the system. The main purpose of performing this type of testing on a system is to track data that could be used by an outsider, such as a hacker, to gain unauthorized access to the system.

Once a vulnerability is discovered in a system, the hacker can use that vulnerable area to gain access to the system or to obtain sensitive information from the system. Those who conduct penetration tests on systems are referred to as “ethical hackers”. These types of hackers are hired by organizations to find vulnerable parts of applications and later damage or destroy the system by preventing these vulnerable parts from being discovered by unauthorized hackers.

Who are the customers that need Penetration Testing?

MASON recommends that penetration testing be performed when:

Benefits of conducting penetration testing

Provides detailed information about actual security threats and helps classify the severity of vulnerabilities. Customers can prioritize their response to vulnerabilities, apply necessary security patches, and allocate security resources. In addition to this, the customer will receive the following benefits:

Types of Penetration Testing MASON Offers

The types of penetration tests are as follows:

• External and internal network security testing
• Web Application Security Testing
• Stakeholder security testing
• Remote access testing
• Social engineering testing
• Physical Security Testing

Steps of Penetration Testing

1. Pre-attack phase/plan	Define intruder model (internal or external, valid privileges and permissions). Definition of goals, source data, scope of work, and test objectives. Determine the scope of the target environment. Develop test methodology. Definition of interaction and communication procedures.
2. Attack phase/testing	Fieldwork and service identification. Develop custom scanning and penetration tools as needed. Detect and scan for vulnerabilities and eliminate false positives. Exploit vulnerabilities and gain unauthorized access. Use the compromised system as a springboard for further intrusion attempts.
3. Post-attack phase/reporting	Analysis and reporting of results and recommendations for risk reduction. Visual representation of the damage done to the system by the intruder. In addition, possibility to eliminate any vulnerabilities detected.

Deliverables to the client

At the conclusion of the penetration test, an extensive report and recommendations for effectively eliminating the detected vulnerabilities will be provided to the client.

List of vulnerabilities detected and written response policy will also be provided.

A list of system vulnerabilities detected, categorized according to how likely they are to be exploited and how harmful they are to the system and the business, and a written response plan will be provided.

A list of system changes implemented during testing will also be included.

A list of testing protocols, including devices used, tools, areas checked, and findings will be provided.