Things to know about the pen test, Penetration Test, Ethical Hacking

Interesting Facts About Pen Test

A penetration test, colloquially known as a pen test, pentest or ethical hacking, is an authorised simulated cyber attack on a computer system that is carried out to assess the security of the system. A penetration test – or pentest for short – is used to determine the state of IT security and the extent to which IT systems or other networks are vulnerable to hackers.

IT systems (or information technology systems) now play a major role in our daily lives. This generally refers to all types of electronic data processing systems. However, precisely because they have become so important to us, they are often the target of hacker attacks. Cyber criminals try to detect vulnerabilities in programmes and servers in order to ultimately profit from them. As IT systems and software programmes are highly complex, it is not easy to take the right protective measures. This is where the pen test comes into play.

What happens during a Pen Test?

The pen test is usually carried out by IT security experts. They use the same methods that are used by hackers. In this way, the pen tester establishes where the security gaps in a system are and to what extent the virus protection used can withstand the threats.
The pen tester keeps a careful log of the execution and results of these ‘test hacker attacks’ so that ways can be identified afterwards. This enables the pen tester to eliminate the existing vulnerabilities. Finally, the results of the pen test report are discussed with the client and the further course of action is discussed with the client.
Ultimately, the client is responsible for ensuring that the security vulnerabilities found are also eliminated.

Historical Aspect

According to security expert Deborah Russell, ‘the 1960s marked the true beginning of the age of computer security’. And indeed, security concerns were already emerging in the 1960s with the new communication possibilities and time-sharing computer systems. As potential dangers were recognised, the penetration test was born. It was first carried out by the United States Department of Defence (DoD) in 1967 to increase the security of US computer systems.
The leading penetration expert at the time, James P. Anderson, drew up a basic recipe for companies to follow when carrying out penetration tests in order to achieve the greatest possible success, which he continued to refine over time. Even today, numerous security experts still work according to the ‘Anderson Penetration Test’.

The relationship between pen tests and data protection

Before the pen test is carried out, the client must sign a declaration of consent. If this is not the case, the tests are illegal. The client must also make it clear in advance which objects and components are under their responsibility. Networks and IT systems from third-party providers must be excluded from the tests.

Who is a pen test useful for?

As, in principle, any company or institution can fall victim to a hacker attack, IT security officers should generally consider appropriate protective measures to protect sensitive data from theft.
For example, it can be fatal for public authorities if a hacker steals personal data. Hackers can also target the business knowledge of successful companies. This usually results not only in financial losses, but also in damage to the company’s image. In any case, the greatest possible data security and data protection should be ensured.
A pentest can provide good service here by ensuring that vulnerabilities are recognised in good time and that things don’t get that far in the first place.

The pen test in contrast to the vulnerability or security scan

Penetration tests, vulnerability and security scans can all be summarised under the generic term vulnerability analysis.
The difference is that vulnerability or security scans are carried out by automated programmes to identify security gaps, whereas a penetration test cannot be automated at the moment. A suitable method is selected and customised individually for the system to be tested, with pentesters also using different pentest tools. Accordingly, the costs for a pentest are also higher, as it is much more time-consuming in terms of planning and implementation.

What types of pen test are there?

The type of pen test used depends on the company and IT infrastructure. Some go deeper, others are more superficial. The components that are most likely to be a weak point also play a role.

These are the most common pen test methods:

1. DDos tests (denial of service): This involves the ‘attacker’ making heavy use of certain resources (e.g. RAM) with the aim that the computer eventually stops responding. This makes it possible to determine whether the security software can withstand a DDoS attack and, if so, for how long.
2. Out-of-band attacks: Here, the hacker destroys systems by deliberately violating the standards for IP headers.
3. Application security tests: The hacker uses this to check applications for data traffic, e.g. the quality of information encryption.
4. War dialling: In this technique, the hacker systematically calls a large number of telephone numbers in order to identify connections for remote maintenance of computers in companies. As soon as an access device is found, the hacker checks various techniques to see whether it is possible to gain access to the company network.
5. Pen test for WLANs: Through these tests, the hacker checks the network security by identifying security gaps in a company’s wireless network.
6. Social engineering tests: Here, the hacker attempts to track down employees as ‘weak points’. The improvised hacker tries to gain access to sensitive data through the employee under a pretext. This is also possible through phishing.

This is just a selection of methods that can be used in penetration tests. It would go beyond the scope of this article to list them all. You can also find more information on this topic on the website of the Federal Office for Security and Information Technology. The BSI has compiled interesting information about penetration testing in a ‘Practical guide for IS penetration tests’.