Penetration testing: what it can do for your business?

Penetration testing: what it can do for your business

?

If you run a business you'll already know the importance of safeguarding your information assets from compromise by so-called "black hat hackers", or "crackers". These people think nothing of taking down your network, defacing your website, or penetrating your internal network to cause havoc among your computer systems.

The solution to this problem is penetration testing, also known as ethical hacking. Businesses contract with so-called "pen testers" to do their utmost to attack the business in the same way that a criminal might, though stopping short of causing any damage. The outcome of penetration testing is a business-focused report that outlines the impact on business processes, rather than the technical details of the test.

One way of looking at penetration testing is as follows. If you come in from the pub at two in the morning and leave your keys in the door, that is a vulnerability. An automatic vulnerability scan would find this, and would offer suggestions to your wife such as "Remove his keys but you need to get up at two in the morning to let him in", "Install a swipe card system" or even "Kick him out of the house!"

A penetration tester, on the other hand, would go up to the door and turn the keys and handle, only to find you had been sober enough to bolt the door from the inside; i.e. the supposed high risk of the vulnerability has been fixed. The tester would then take the keys and try the back door, before stealing your car! In other words, the vulnerabilities are exploited to find the true business impact and not just the theoretical technical weaknesses. The advantage of using a manual penetration tester, rather than an automated tool, is that the ethical hacker is more likely to discover the true business-related risks to your information assets.

There are different types of penetration test:

White box test: Full knowledge of the systems to be tested is provided in advance. This kind of penetration testing can be more thorough.

Black box test: This assumes no knowledge of the systems being tested, and mimics the actions of black hat hackers.

The phases of a "pen test" are as follows:

Research: Check publicly-available information about network addresses and IT deployment that could be of use to a potential attacker.

Enumeration: Scan by appointment with the organisation and identify the systems and architectural features.

Exploitation: Analyse the potential for successful attacks, stopping short of causing damage or disruption to systems.

Analysis and reporting: Correlate with known vulnerabilities, examine findings, inform client and reach conclusions on business impacts.

If your business depends crucially on its information assets and what business doesn't? then penetration testing is a vital safeguard that you cannot afford to ignore.

POST COMMENT

A Review of its Structure Will Help a Business Determine Whether its Growth is Being Held Back Short Term Loans No Credit Check - Grasp Fast Cash without Any Hassles Xmas Loans Bad Credit - When You Run Short Of Cash Affiliate Marketing Tips For Rapid Business Expansion Unsecured Business Loans: Finance Your Projects With Ease Same Day Cash Loans: The Best Solution Of Any Fiscal Emergency Unsecured loans- Easy and Simple Cash Credits To Gain Astonishing Contracts! Personal Loans With No Credit Check: Heres The Chance For Cash Advances Helpful Ideas In Putting Up A Business In Singapore An Online Home Based Business in Online Marketing The Possibilities Of Selling Your Business Online Will Cross Your Mind With Buymeprivate.com Working for a Legitimate Online Business Learn These Effective Ways To Promote A Business Online