If you’re reading these lines, you are probably wondering what is Penetration Testing and how is it important to my business? Let me explain.
Penetration Testing is a method to determine the security levels of a computer, network, technological device or servers that contain data, but how do we determine that?
We simulate a cyber-attack on the target, in order to analyze and investigate the system’s defense and it’s reaction to a cyber-attack.
We generally work with three different types of Penetration Testing, each test is fitted to the field it belongs to.
Black Box
White Box
Gray Box
Don’t worry, we won’t leave you like that Black Box:
We could use this Penetration Test as an outer test, and start this attack from outside the system into it.
As an example, If the attacker succeeded in reaching his target and fulfilling the key limitations agreed upon, then you are allowed to stop the attack and report back.
Black Box Pentesting, is an attack on the fact that the attacker has no previous knowledge of the target, any information related to the company is deducted from the file the attacker receives, so it’s mission is to reach the goals without any preparation, just like a random attacker would.
This Penetration Test usually takes longer, because large portion of the test is collecting information.
There is a small disadvantage to this test, it does not fully cover all the systems of the business.
In that way, you are simulating an attack from an outside source.
In example, on Web Application Penetration Testing you would test the app or website, when you have no previous information about it, without any access to the system, code or it’s schema, and still finding errors in the code itself.
White Box:
While not being solely Internal Penetration Testing, the White Box Penetration Testing is different than the Black Box, this time the attacker receives the full intel on the target, information about the systems, defenses and more, allowing it to perform a full and comprehensive attack on the organization in order to find as many vulnerabilities as possible.
In this attack, the tester does not need to path his way to the systems of the organization, it simulates an attack from inside the system, like an employee or physical intrusion to the organization.
Time is important, so this attack is rather faster than the Black Box, which gives you maximal use of the attack time to find as many vulnerabilities as possible inside the code.
For example, in the software field it means the tester gets all the source code of that software and detailed information of it, in order to find the vulnerabilities from the developers side.
Gray Box:
In this attack the tester receives small amount of information about the organization and the information systems, in some cases even a partial access to the organization’s network and the attack can be performed from within or outside the organization, depending on the goals set and the amount of information the attacker gets.
You simulate an attack both from the developer side and the “outside” of the software or application, this attack can be fit to your needs and is considered very comprehensive
As proof of success and data verification, the attack will provide us with some or all of the following information:
Executive access passwords
Database passwords
Screenshots from protected systems
Confidential documents
Also, the report provided will include
Data of the organization’s internal network
Vulnerability Scan
Relevant Possible Exploits
Attack attempts
Human analyzed information of the attack
So, now you understand much more about Penetration Testing, maybe it’s time to contact us and we will scan your organization, so you’re safe from the next cyber attack.
