As you may guess from its name, a pentest is a specialized type of information security assessment that inspects how a technology (applications, software components and infrastructure) can be infiltrated by simulating a cyberattack. Expert security practitioners use purpose-built tools and procedures to identify vulnerabilities that can be dormant and undetected simply because software developers and vendors have other goals and employ a different way of thinking than a motivated and skilled hacker.
Today, penetration testing (in short: ″pentesting″) has become a well-established best practice. While this approach was common practice a few years ago, especially in IT-heavy industries such as the finance or telecommunications sectors, pent-up development is advisable or even necessary for all sectors as digitalization progresses.
The goal is to find as many security relevant configuration issues and known vulnerabilities as possible, in addition to previously unknown security issues (so called zero-day vulnerabilities), as in a set amount of time. This approach is called a “timebox” and is generally based on budget, timing and process.
A real attacker does not necessarily stop after infiltrating a certain technology. Personal, classified or other data worth protecting are his grail before he turns to installing malware and gathering all the worthwhile resources he can for later exploit. Needless to say, all of which could jeopardize your company’s image and lead to severe financial and reputational loss.
It is advisable to provide the pentester with sufficient time and to repeat pentests at certain intervals. After several thousand penetration tests, it is clear that there is “always something to be found”.
Non-functional requirements
As security is a non-functional requirement, the service or software may work as designed on its own but still contain a large amount of vulnerabilities that make its use dangerous for any service provider and/or user. These vulnerabilities can originate from the software product itself or result from of misconfiguration of the underlying infrastructure. A pentest reveals what could possibly go wrong in the case of an attack. Every organization, regardless of its size, that processes data or uses digital methods of communication is prone to such a cyberattack. In a digital world like ours, the question arising is then not IF there will be an attack but WHEN.