PENETRATION TESTING

Types of Penetration Test

Different types of penetration testing will focus on different aspects of your perimeter – the boundary that separates your network from the Internet.

Infrastructure (Network) Penetration Tests

Network penetration tests aim to identify and test security flaws, whether that be flaws in servers and hosts, misconfigured wireless access points and firewalls or insecure network protocols.

External Infrastructure (Network) Penetration Tests

External penetration tests identify and test security vulnerabilities that might allow attackers to gain access from outside the network.

Internal Infrastructure (Network) Penetration Tests

Internal penetration tests focus on what an attacker with inside access could achieve. An internal test will usually be done from the perspective of both an authenticated and non-authenticated user to assess potential exploits. It will check vulnerabilities affecting systems that are accessible by authorised login IDs and that reside within the network and check for misconfigurations that could allow employees to access information and inadvertently leak it online.

Wireless Network Penetration Tests

If you use wireless technology, such as Wi-Fi, you should also consider wireless network penetration tests. Identifying Wi-Fi networks, including wireless fingerprinting, information leakage and signal leakage whilst determining encryption weaknesses, such as encryption cracking, wireless sniffing and session hijacking.

Web Application (software) Penetration Tests

Web application tests focus on vulnerabilities such as coding errors or software responding to certain requests in unintended ways.

Social Engineering Penetration Tests

As technical security measures improve, criminals increasingly use social engineering attacks such as phishing, pharming and BEC (business email compromise) to gain access to target systems.

So, just as you should test your organisation’s technological vulnerabilities, you should also test your staff’s susceptibility to phishing and other social engineering attacks.