Planning for penetration testing

Penetration testing, or pen testing, is another method for identifying security risks and an important function of a mature security program. Pen tests validate risk by performing specific activities against targets in your environment, such as system hosts, applications, users, and devices to exploit known vulnerabilities. Tests are executed by skilled security professionals, referred to as ethical hackers, to try and replicate the activities of a malicious actor. This practice is commonly referred to as ethical hacking.

Penetration tests can be executed externally to simulate an outside threat trying to break in, or internally, to simulate an insider threat that has breached your perimeter network. There are many different types of penetration tests, and commonly cover the following areas:

• Systems and servers including Active Directory
• Web, API, and mobile applications
• Databases
• Networks (internal/external/DMZ), including wireless...