The previous article, defined Penetration Testing and explained why it is critical and who carries it out. Now we will review several different kinds of Penetration Tests that are available. The test that will best suit your needs can be determined by first conducting a Risk Assessment. This will tell you in detail which of your digital assets are the most, moderately, and least vulnerable to a Cyberattack. Obviously, you will want to do a Pen Test on the most and moderately vulnerable assets.
The six types of Pen Tests most commonly used are as follows:
Web Application Testing
Web Application Testing examines for server-side application vulnerabilities. This typically includes the following:
- Operating systems
- Databases
- Web applications
- Source code
- Application Programming Interfaces (APIs)
- Email systems
- Mobile apps.
Client-Side Testing
Client-side testing typically tests for weaknesses that could lead to hacks into a wireless network, including:
- Any misconfigurations in the web server
- Distributed Denial of Service (DDoS) attacks
- SQL Injection attacks
- Cross Site Scripting (XSS)
- MAC address spoofing.
Social Engineering Testing
These kinds of tests primarily involve what is deemed to be the weakest link in your security chain: your employees. In this regard, you will want to know how likely employees are to fall for the following:
- Eavesdropping
- Phishing attacks
- Posing as a real employee
- Posing a legitimate third-party contractor
- Dumpster diving
- Fake phone calls seeking access to confidential information/data.
Physical Testing
Physical testing ascertains the security gaps which could lie in your physical assets, which include:
- Servers
- Workstations
- Wireless Devices.
Network Exploitation (NE) / Network Attacks (NA)
- With Network Exploitation, the Red Team tries to determine the likelihood of your network being taken over in order to launch an attack on an entirely different network.
- With Network Attacks, the Red Team tries to ascertain how susceptible your network is to widespread corruption due to malware, Trojan Horses, Ransomware, etc.
Cloud Infrastructure Testing
The juggernauts here are the Amazon Web Services (AWS) and Microsoft Azure. While these providers do have a suite of security tools that you can make use of for your deployments, they do not assume responsibility for any security breaches that occur to your SaaS, PaaS, or IaaS. Therefore, the Red Team is particularly interested in testing for any vulnerabilities that could exist in your Virtual Machines (VMs).
Conclusion
Now that you understand what Pen Testing is, its importance, and the various testing methods available, you can develop a strategy that is tailored to your organization’s needs and potential Cyber vulnerabilities. Your reward for being thorough and proactive in this regard will be better protection against Cyberattacks.
Ravi Das is a Cybersecurity Consultant and Business Development Specialist. He also does Cybersecurity Consulting through his private practice, RaviDas Tech, Inc. He also possesses the Certified in Cybersecurity (CC) cert from the ISC2.
Visit his website at mltechnologies.io
