What is Penetration Testing?

In a previous blog post, we discussed the differences between penetration testing and vulnerability scanning.  

However, those of us at MainNerve realized that sometimes we are so involved in this world that there may be things that the general populace may not inherently understand about penetration testing. Therefore, we asked some of our staff their take on what penetration testing is. 

Here are a few of the responses on what penetration testing is.

• “Penetration testing is a targeted manual approach to identifying and exploiting vulnerabilities in an organization. Depending on the scope, this could include their wireless infrastructure, web applications, internal and external networks, personnel (e.g., social engineering campaigns), physical security, mobile devices, and source code.”
• “To me, a penetration test is a point-in-time assessment of possible vulnerabilities and misconfigurations. The assessment consists of simulating threat actor activity to gain access to information systems.”
• “I would say that a penetration test uses adversarial tactics, techniques, and procedures to discover and exploit vulnerabilities on a system. Then providing recommendations to secure the network against vulnerabilities found.”

One member of our staff explained more of what they do while actively testing.

• “I place myself in the shoes/mindset of an attacker with the goal of circumventing the security measures of a network/web app/computer in a controlled manner to identify weaknesses so that you can close those weaknesses.”

These responses show that MainNerve staff uses a combination of automated and manual testing. However, there is an emphasis on manual testing. 

MainNerve’s staff uses the mindset of an unethical hacker coupled with ethical and responsible testing techniques. This ensures thorough testing of our client’s assets without the risk of damage to those assets. 

Our final report will provide details on each vulnerability identified and recommendations for mitigating/remediating each security concern.

MainNerve does not complete those remediations; instead, we provide a third-party check for any company seeking a penetration test. The hiring company’s IT team or MSP can then view the report and manage those fixes.