{"id":19043,"date":"2022-11-26T13:15:10","date_gmt":"2022-11-26T13:15:10","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/11\/26\/how-penetration-testing-keeps-systems-safe\/"},"modified":"2022-11-26T13:15:10","modified_gmt":"2022-11-26T13:15:10","slug":"how-penetration-testing-keeps-systems-safe","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/11\/26\/how-penetration-testing-keeps-systems-safe\/","title":{"rendered":"How Penetration Testing Keeps Systems Safe"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n
\"Digitial
VallepuGraphics\/Shutterstock.com<\/a><\/span><\/figcaption><\/figure>\n

Penetration testing is a way for cybersecurity experts to test a system by simulating an attack. It involves intentionally trying to get past existing security, and it can help companies find out if their systems can withstand a hack.<\/p>\n

If you\u2019re reading about cybersecurity<\/a>, the term penetration testing will come up as a way to see if systems are secure. What is penetration testing, though, and how does it work? What kind of people perform these tests?<\/p>\n

What Is Pen Testing?<\/h2>\n

Penetration testing<\/a>, often referred to as pen testing, is a form of ethical hacking in which cybersecurity professionals attack a system to see if they can get through its defenses, hence \u201cpenetration.\u201d If the attack is successful, the pen testers report to the site owner that they found issues which a malicious attacker could exploit.<\/p>\n

Because the hacking is ethical, the people performing the hacks aren\u2019t out to steal or damage anything. However, it\u2019s important to understand that in every way besides intent, pen tests are attacks. Pen testers will use every dirty trick in the book to get through to a system. After all, it wouldn\u2019t be much of a test if they didn\u2019t use every weapon a real attacker would use.<\/p>\n

Pen Test vs Vulnerability Assessment<\/h3>\n

As such, penetration tests are a different beast to another popular cybersecurity tool, vulnerability assessments. According to cybersecurity firm Secmentis<\/a> in an email, vulnerability assessments are automated scans of a system\u2019s defenses that highlight potential weaknesses in a system\u2019s setup.<\/p>\n

A pen test will actually try and see if a potential issue can be made into a real one that can be exploited. As such, vulnerability assessments are an important part of any pen testing strategy, but don\u2019t offer the certainty that an actual pen test provides.<\/p>\n

Who Performs Pen Tests?<\/h2>\n

Of course, getting that certainty means that you need to be pretty skilled at attacking systems. As a result, many people working in penetration testing are reformed black hat hackers<\/a> themselves. Ovidiu Valea, senior cybersecurity engineer at Romania-based cybersecurity firm CT Defense<\/a>, estimates former black hats could make up as many as 70 percent of the people working in his field.<\/p>\n

According to Valea, who is a former black hat himself, the advantage of hiring people like him to combat malicious hackers is that they \u201cknow how to think like them.\u201d By being able to get into an attacker\u2019s mind, they can more easily \u201cfollow their steps and find vulnerabilities, but we report it to the company before a malicious hacker exploits it.\u201d<\/p>\n

In the case of Valea and CT Defense, they\u2019re often hired by companies to help fix any issues. They work with the knowledge and consent of the company to crack their systems. However, there is also a form of pen testing that\u2019s performed by freelancers who will go out and attack systems with the best of motives, but not always with the knowledge of the people running those systems.<\/p>\n

These freelancers will often make their money by gathering so-called bounties via platforms like Hacker One<\/a>. Some companies\u2014many of the best VPNs<\/a>, for example\u2014post standing bounties for any vulnerabilities found. Find an issue, report it, get paid. Some freelancers will even go so far as to attack companies that haven\u2019t signed up and hope their report gets them paid.<\/p>\n

Valea warns that this isn\u2019t the way for everybody, though. \u201cYou can work for several months and find nothing. You will have no money for rent.\u201d According to him, not only do you really need to be very good at finding vulnerabilities, with the advent of automated scripts there isn\u2019t much low-hanging fruit left.<\/p>\n

How Do Penetration Tests Work?<\/h2>\n

Though freelancers making their money by finding rare or exceptional bugs reminds a bit of a swashbuckling digital adventure, the daily reality is a bit more down to earth. That\u2019s not to say it isn\u2019t exciting, though. For every type of device there is a set of tests used to see if it can stand up to an attack.<\/p>\n

In each case, pen testers will try and crack a system with everything they can think of. Valea emphasizes that a good pen tester spends a lot of his time simply reading reports of other testers not just to stay up-to-date on what the competition may be up to, but also to gain some inspiration for shenanigans of their own.<\/p>\n

However, gaining access to a system is only part of the equation. Once inside, pen testers will, in Valea\u2019s words, \u201ctry to see what a malicious actor can do with it.\u201d For example, a hacker will see if there are any unencrypted files to steal. If that\u2019s not an option, a good pen tester will try and see if they can intercept requests or even reverse engineer vulnerabilities and maybe gain greater access.<\/p>\n

Though it\u2019s not a foregone conclusion, the fact of the matter is that once inside there\u2019s not much you can do to stop an attacker. They have access, and they can steal files and wreck operations. According to Valea, \u201ccompanies aren\u2019t aware of the impact a breach can have, it can destroy a company.\u201d<\/p>\n

How Can I Protect My Devices?<\/h2>\n

While organizations have advanced tools and resources like pen tests to safeguard their operations, what can you do to stay safe as an everyday consumer? A targeted attack can hurt you just as much, though in different ways than a company suffers. A company having its data leaked is bad news, for sure, but if it happens to people it can ruin lives.<\/p>\n

Though pen testing your own computer is probably out of reach for most people\u2014and likely unnecessary\u2014there are some great and easy cybersecurity tips<\/a> you should follow to make sure you don\u2019t fall victim to hackers. First and foremost, you should probably\u00a0test any suspicious links<\/a> before you click on them, as that seems to be a very common way hackers attack your system. And of course, good antivirus software<\/a> will scan for malware.<\/p>\n<\/div>\n