Penetration testing, or “pentesting”, is an authorised security assessment that is performed on systems, applications, or networks. It is carried out with explicit permission from the system owner within agreed boundaries.
Penetration testing is important because modern systems are complex and constantly changing. These factors make it difficult for organisations to identify all weaknesses through design and development alone. Well-built systems can also contain weaknesses that could expose them to attacks. A penetration test fills this gap and helps organisations understand how these weaknesses could be abused, which allows them to prioritise fixes and reduce risk before the weaknesses can be exploited by attackers.
Penetration testing is an essential security service for many reasons. It ensures that organisations can prioritise remediation efforts based on the level of risk associated with the weaknesses. It helps protect the confidentiality of sensitive customer data such as payment information or personally identifiable information (PII), which ensures compliance with many regulatory frameworks and industry standards such as Payment Card Industry Data Security Standard (PCI-DSS) and General Data Protection Regulation (GDPR). Real-world attack scenarios and assessment of the overall security posture of an organisation ensures that security controls are effective. This process provides assurance to the leadership, stakeholders, and customers that weaknesses are being addressed proactively.
Penetration Testing vs Malicious Hacking
While penetration testers and malicious attackers may use similar tools, the way they operate is totally different. The core factors in the table below separate penetration testing from malicious hacking:
| Core Factor | Penetration Tester | Malicious Attacker |
|---|---|---|
| Authorisation | Penetration testers operate with explicit written consent from the system owner. | Attackers operate without consent and violate the rights and security of the organisation. |
| Scope | Penetration testers operate within a clearly defined scope that is set by the organisation in order to protect critical systems. | Attackers are not restricted by scope and will target anything that helps them achieve their goal. |
| Coverage | Penetration testers aim for broad coverage and assess multiple areas of a system. | Attackers focus on the quickest or most effective path to success, and often target systems and data that can provide financial benefit. |
| Responsibility | Penetration testers are accountable for their actions and the impact of their work, and are expected to act professionally at all times. | Attackers do not feel accountable for their actions and do not take responsibility for the damage that they cause. |