Penetration testing is a process of simulating a cyberattack on a system, network, or application to identify and exploit vulnerabilities. It is an essential practice for improving the security posture and resilience of an organization. But how do you choose targets for penetration testing? Here are some factors to consider.
Before you start a penetration testing project, you need to define the scope and objectives of the test. The scope determines what systems, networks, or applications are in scope, and what are out of scope. The objectives define what you want to achieve from the test, such as finding specific vulnerabilities, testing compliance, or assessing risk. The scope and objectives should be aligned with the business goals and security policies of the organization, and agreed upon by all stakeholders.
Often choosing a goal of a data set such as financial data or IP is used for organizations who are not regularly pentesting. While this can be effective in understanding how to protect the key things, it's important to not limit the attack vectors. If you don't test all possible routes to that data you will get a false sense of security. This includes network, application, physical, social and all the nuances around it.
A threat model is a systematic way of identifying and analyzing the potential threats and risks that face your target. It helps you prioritize the most relevant and realistic attack scenarios, and plan your testing strategy accordingly. A threat model can include elements such as the assets, attackers, attack vectors, attack surfaces, vulnerabilities, and countermeasures of your target. You can use tools and frameworks such as STRIDE, DREAD, or PASTA to create and document your threat model.
Choosing the right testing tools is crucial for conducting a successful penetration test. You need to select tools that match your skill level, testing methodology, and target environment. There are many tools available for different stages and types of penetration testing, such as reconnaissance, scanning, exploitation, post-exploitation, and reporting. Some of the most popular tools are Nmap, Metasploit, Burp Suite, Wireshark, and Kali Linux. You should also update your tools regularly, and use them ethically and responsibly.
When performing a penetration test, there are different testing methods to choose from depending on the level of information and access you have to your target. Black box testing involves no prior knowledge or access to your target, while white box testing requires full knowledge and access, and gray box testing involves some knowledge and access. Each method has its own pros and cons, so it's important to select the one that best suits your objectives and scope.
Conducting a penetration test in a consistent, comprehensive, and professional manner requires following testing standards. These standards provide guidelines and best practices for planning, executing, and reporting a penetration test. They also help you meet legal and ethical requirements, and prevent any unnecessary damage or disruption to your target. Popular testing standards include NIST SP 800-115: Technical Guide to Information Security Testing and Assessment, PTES: Penetration Testing Execution Standard, OWASP: Open Web Application Security Project Testing Guide, OSSTMM: Open Source Security Testing Methodology Manual, and ISO/IEC 27001: Information Security Management System. When choosing a testing standard for your target, make sure it is relevant and applicable to your needs. Following the standard throughout the penetration test is essential.
The frequency of penetration testing depends on several factors, such as the type, size, and complexity of your target, the level of risk and change it faces, and the regulatory and contractual obligations it has. There is no one-size-fits-all answer, but a general rule of thumb is to conduct a penetration test at least once a year, or whenever there is a significant change or event that affects your target. You should also monitor your target continuously, and perform regular vulnerability scans and audits to keep it secure.
Moving to a 'continual testing' methodology is the mature path. The need to test for compliance requirements will always dictate those specific tests, but to get the most from your testing integrating attack surface management with pentesting for validation and risk identification provides an enormous value.