Pentesting: What is it?

Testing the components of your IT environment is an ongoing and sometimes daunting task. In order to improve your cybersecurity posture, it is critical to stay abreast of the latest attack techniques, as well as test and evaluate your defenses against those threats.

Numerous companies have been the target of cyber-attacks, and in order to counter this avalanche of virtual attacks, consultancies such as ActiveSys have a duty to make the public aware of the constant cyber-crimes and keep them informed about the most diverse forms of protection.

Thus, ActiveSys today focuses on a recent technology called Penetration Testing.

Pentest or Ethical Hacking, is a security exercise in which a cybersecurity expert attempts to find and exploit vulnerabilities in a computer system.

The main objective of this simulated attack is to identify weak points in the defenses, which hackers can take advantage of, while at the same time reducing the attack surface. In addition to testing vulnerabilities, this simulation seeks to test employees and processes.

Preferably, these tests should be carried out by external elements, who have no knowledge of the security policy that the company adopts. These are often called ethical hackers, since they have been hired to break into a system, with authorization and with the purpose of increasing security.

There is no one-size-fits-all pentesting, meaning that the environments, risks and adversaries are different from one organization to another. Furthermore, there are several types of pentesting.

According to CrowdStrike, there are six types of PenTests:

This type of test assesses the organization’s internal systems, with the aim of determining how an attacker might move throughout the network.

The external one, on the other hand, assesses the systems aimed at the Internet, with the purpose of identifying whether there are exploitable vulnerabilities that expose data or unauthorized access to the outside world.

Identifies risks and vulnerabilities that may expose confidential internal resources and assets to unauthorized elements.

It analyses the web application in three steps:
– recognition (where the team discovers information such as the operating system, services and resources in use);
– discovery (identifying vulnerabilities);
– exploitation (taking advantage of weaknesses to gain unauthorized access to sensitive data).

Here, the risks and weaknesses associated with the wireless network are identified, assessing weak points.

This type of penetration testing identifies physical security risks and weaknesses in order to gain access to a corporate computer system.

Usually, in these tests, the first step is reconnaissance, during which time an ethical hacker will collect all the data and information they will use to carry out the simulated attack.

After the overview, the next step is the planning of the whole process.

Then, the goal is to gain and maintain access to the system, through a wide range of tools such as SQL Injections and social engineering techniques that make it easy to find unprotected elements. Some examples of techniques used are sending Phishing emails and disguising themselves as deliverers.

In the end, the professional analyses and shares the results with the target company’s security team, which then solves the detected security problems.

Thus, the ideal time to perform such tests is before a breach occurs, and at least once a year, because, as the popular saying goes, “prevention is better than cure”.
However, it is advisable to perform these exercises every time elements are added to the network infrastructure, or whenever there is a significant overhaul in key assets.

Teaming is the penetration testing methodology that companies use to better organize their cyber security credentials. The Red Team, already mentioned in a previous article, often uses this type of exercise, as it can detect and expose vulnerabilities through social engineering, phishing techniques, among others.

ActiveSys is the ideal support to help your company implement these methodologies that guarantee maximum security. Do not hesitate to contact us.

ActiveSys, we activate your business.