What is a Penetration Test & How Do You Request One?

As we continue to rely on the interoperability of our computer systems in our everyday lives, we must remember this interconnectivity comes with a price. The ability to access devices remotely over the internet has created a new world of ease and freedom which can be manipulated by malicious actors. It’s quite eye-opening in its simplicity: If a device is exposed on the internet it has the possibility of being compromised.   

Organizations must face the reality that hackers are out there searching for their next victim. In 2019, the publication Recorded Future reported on the 100th publicly reported state or local government hit with a ransomware attack.[ii] These types of numbers are alarming and should motivate every organization to bolster their information security budgets not only for better defenses but also for security awareness training.  

Why do You Need Penetration Testing?

Organizations can’t help but to expose some services over the internet. For instance, items such as virtual private networks (VPNs), secure file transfer protocols (SFTPs), hypertext transfer protocol (HTTP) logins, email, application programming interface (APIs), and others will require exposure to the internet. But these items also often become the target of a hacker. Hackers will scan the internet looking for specifically–known ports containing exposed running services that can be exploitable. Hackers will eventually find the services you’re hiding and will test your defenses. How will your perimeter defenses hold up against possible attacks? 

Organizations can take steps to protect themselves against hackers and make their environment unappetizing (read: difficult to hack) for any attacker. Testing systems through vulnerability scanning is now a common practice companies use to gain meaningful insight into both their internal and external security postures. These high-level automated vulnerability scans provide information regarding the versioning of systems, identify exposed services and determine the associated risk of those findings. A vulnerability scan can help an organization determine if their configurations are following best practices and if system patching occurs regularly.  

New vulnerabilities are discovered every day and once a discovery is reported, that specific software or hardware vendor must scramble to remediate the issue through a patch and then push those patches out to its clients. If a vulnerability exists and a patch is not applied it creates a possible vector for a hacker to pinpoint. This is where the difference between a vulnerability scan and penetration test begin to diverge.  

What is a Penetration Test?

A penetration test can utilize information obtained from vulnerability scans and probe it further to discover possible areas of exploitation. A penetration test will provide the organization with a live assessment of real-world techniques to obtain unauthorized access into your network.  

During a penetration test an ethical hacker will review and plan a course of action to perform exploits and test different perimeter defenses. Additional tactics such as social engineering to obtain user access are also common practices that can be included in a penetration test. Often an attacker will spray an organization with fraudulent emails attempting to either inject malware into the company network or trick the user into entering the network credentials into a malicious site, which are sent directly to the attacker. According to the Verizon Data Breach Investigations Report 2019   phishing is still the number one technique hackers utilize to attack an organization.  [i] 

Once a hacker has obtained a user’s credentials the next step will be to access the network and pivot, or move from one system to another, to obtain access to different systems. The hacker may also try to obtain administrator–level credentials for further access into the network. If administrator credentials are obtained, an attacker can create several different backdoors back into the organization, which can be extremely difficult to detect. 

The type of a pen test required will need to be decided by each organization:  

Types of Penetration Testings

Web Application Penetration Testing

Web application pen testing will test an application for weakness in several different ways.  

Internal Penetration Testing

An internal pen test could simulate an insider threat. This attack could originate from a remote user’s credentials being compromised and provide VPN access to a hacker. In this scenario the attacker has access to the internal network but must bypass any internal controls to access sensitive systems.  

External Penetration Testing

The last type of attack is an external attack, which is the most common and requires an external pen test. This type of external attack simulates a hacker with no knowledge of your infrastructure who attacks only the external scope, that has been provided for testing in order to attempt to breach the internal network.  

Ethical hackers will simulate a real-life attack scenario as realistically as possible. Penetration testing will strengthen your organization’s security posture. The findings from a penetration test can provide valuable information to your data security staff. 

As interoperability continues to grow, the risk of the healthcare space attracting more hackers will only continue. While companies grapple with difficult issues such as managing third-party access and tracking, the prevalence of remote access workers and the constant threat of human error, it is inevitable the probability of creating vulnerabilities that a hacker can and will eventually exploit will increase. It’s important to stay a step ahead of all the scary things that lurk on the internet.  

[i]  https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf 

[ii] https://www.recordedfuture.com/state-local-government-ransomware-attacks-2019/