Penetration testing
How to get the most from penetration testing
Introduction
Penetration testing is a core tool for analysing the security of IT systems, but it's not a magic bullet.
This guidance will help you understand the proper commissioning and use of penetration tests. It will also help you to plan your routine security measures so that you gain maximum benefit from this powerful but expensive operation.
What is penetration testing?
For the purposes of this article, we will define penetration testing as: "A method for gaining assurance in the security of an IT system by attempting to breach some or all of that system's security, using the same tools and techniques as an adversary might."
Penetration testing should be viewed as a method for gaining assurance in your organisation's vulnerability assessment and management processes, not as a primary method for identifying vulnerabilities.
A penetration test should be thought of as similar to a financial audit. Your finance team tracks expenditure and income day to day. An audit by an external group ensures that your internal team's processes are sufficient.
Pen-testing: the ideal
In an ideal world, you should know what the penetration testers are going to find, before they find it. Armed with a good understanding of the vulnerabilities present in your system, you can use third-party tests to verify your own expectations.
Highly experienced penetration testers may find subtle issues which your internal processes have not picked up, but this should be the exception, not the rule. The aim should always be to use the findings of a penetration test report to improve your organisation's internal vulnerability assessment and management processes.
What should a penetration test tell you?
Typically, penetration tests are used to identify the level of technical risk emanating from software and hardware vulnerabilities. Exactly what techniques are used, what targets are allowed, how much knowledge of the system is given to the testers beforehand and how much knowledge of the test is given to system administrators can vary within the same test regime.
A well-scoped penetration test can give confidence that the products and security controls tested have been configured in accordance with good practice and that there are no common or publicly known vulnerabilities in the tested components, at the time of the test.
What sort of system should be tested?
Penetration testing is an appropriate method for identifying the risks present on a specific, operational system consisting of products and services from multiple vendors. It could also be usefully applied to systems and applications developed 'in-house'.
For product-specific testing, it is not an appropriate technique.
Using penetration testing effectively
A penetration test can only validate that your organisation's IT systems are not vulnerable to known issues on the day of the test.
It's not uncommon for a year or more to elapse between penetration tests. So, vulnerabilities could exist for long periods of time without you knowing about them if this is your only means of validating security.
Third-party penetration tests should be performed by qualified and experienced staff only. By their nature, penetration tests cannot be entirely procedural, an exhaustive set of test cases cannot be drawn up. Therefore, the quality of a penetration test is closely linked to the abilities of the penetration testers involved.
The NCSC recommends that HMG organisations use testers and companies which are part of the CHECK scheme.
Types of testing
Penetration testers can be used to perform a wide-range of testing. The following list is illustrative, not comprehensive.
Note
If you have a particular scenario that requires additional assurance, a specifically targeted penetration test may be a good way to obtain that assurance. A suitably qualified penetration testing team will be able to guide you through the selection and scoping process required in this case.
Your testing regime
It's critically important to note that a planned penetration test doesn't mean your normal testing regime should cease to include security tests on the target system. Functional testing of security controls should still occur.
Assessing whether defined security controls are functioning is not a valuable use of penetration testing resources.
A functional testing plan should always include positive tests (such as 'The logon box comes up every time you try to log in and you aren't just allowed in').
Negative testing may be included in your functional testing plan where the skills to perform it are available within your organisation (for example, verifying that 'You can't log in without the correct password').
A model penetration test engagement
A typical penetration test will follow this pattern: Initial engagement, scoping, testing, reporting and follow up. There should be a severity rating for any issues found.
For this model we assume that:
- you wish to know what the impact of an attacker exploiting a vulnerability would be, and how likely it is to occur
- you have an internal vulnerability assessment and management process
Initial engagement of the external team
You should ensure that the external team has the relevant qualifications and skills to perform testing on your IT estate. If you have any unusual systems (mainframes, uncommon networking protocols, bespoke hardware etc.) these should be highlighted in the bid process so that the external teams know what skill sets will be required.
