What the hell is a pen test?

Hint: it’s not about seeing if you still have ink in your pen.

When I first started my internship in Damovo in September, most of the time I had no clue what they were talking about. They are a data, voice and security services company, but to me, they may as well have been speaking Ancient Greek.

I was constantly asking myself questions like the one above. Feeling confused and wondering if it was just me that didn't understand what the conversation was about.

Since then, I have learned the language of cybersecurity and telecoms, and have a much clearer picture of what things are. Here are four random things I have learned about cybersecurity since starting my internship:

1.?Social Engineering – Using deception or psychological manipulation to get people to reveal information or do things that they would not normally do. The classic example is if you have a clipboard and a high-vis vest, you can get into almost anywhere.

2.?Bug Bounty Programs – Companies set up payment programs for ethical hackers to find vulnerabilities in their systems. More details and examples can be found on hackerone.com.

3.?Operational technology (OT) threats – OT is technology that is physical, rather than digital. Think water pumps, factory machinery, air-con units. If hackers can exploit this type of tech, it can have disastrous effects on companies, and can even lead to death or serious injury.

4.?Penetration testing – Also known as pen testing. When a company contracts another company to see if they can exploit their network or other technologies to gain access or control of internal data. Any vulnerabilities found will be explained to the customer, so they can fix them before a bad actor exploits them. Hope you enjoyed reading as much as I enjoyed learning!

Thanks to Andrew Hay for his recent talk where he explained Damovo’s security offerings and answered loads of questions afterwards!

Author: David Langley - intern at Damovo