Planning for penetration testing
Penetration testing is an extremely important function of your security program that shouldn't be overlooked these days. In general, penetration testing validates whether a risk exists by performing a specific task within your environment against systems, applications, devices, users, and so on to exploit the identified vulnerability and prove success. It is typically executed by a security professional who is skilled in hacking techniques and is commonly referred to as ethical hacking. The ethical hacker's role is to try and replicate what a malicious hacker would try to accomplish.
Penetration tests can be executed externally, to simulate an outside threat trying to break in, or internally, to simulate an insider threat and replicate a breach of your environment. There are many different types of penetration tests and they will typically cover the following areas:
- Systems and servers
- Web applications
- Databases
- Networks...
