MWI – Markweb Informatica at your service since 2007 - penetration test

Penetration Test & Ethical Hacking

Definition


A penetration test, colloquially known as a pen test, is an authorized simulated attack on a computer system that looks for security weaknesses, potentially gaining access to the system's features and data.

The process typically identifies the target systems and a particular goal, then reviews available information and undertakes various means to attain the goal. A penetration test target may be:

  • Black box: provides only basic or no information except the company name.
  • White box: provides background and system information.
  • There is another variant called Grey Box.

A penetration test can help determine whether a system is vulnerable to attack, if the defenses were sufficient, and which defenses (if any) the test defeated.

Security issues that the penetration test uncovers should be reported to the system owner. Penetration test reports may also assess potential impacts to the organization and suggest countermeasures to reduce risk.

The goals of a penetration test vary depending on the type of approved activity for any given engagement with the primary goal focused on finding vulnerabilities that could be exploited by a nefarious actor, and informing the client of those vulnerabilities along with recommended mitigation strategies.

Flaw hypothesis methodology is a systems analysisand penetration prediction technique where a list of hypothesized laws in a software system are compiled through analysis of the specifications and documentation for the system. The list of hypothesized flaws is then prioritized on the basis of the estimated probability that a flaw actually exists, and on the ease of exploiting it to the extent of control or compromise. The prioritized list is used to direct the actual testing of the system.