What is Penetration Testing?
How does it work?
Before you consider a penetration test, it’s important to learn how they work and the types of tests available. There are essentially two main types of penetration tests, blackbox penetration testing often called external penetration testing, or whitebox penetration testing, often called internal penetration testing. Blackbox pen testing audits the target from an outsiders perspective, with no prior knowledge of the system, and is generally the most preferred type of test. Whitebox pen testing looks at the target host with insider knowledge, meaning a user account or some form of access has been granted to the penetration tester. Whitebox tests are often done after an initial blackbox test in order to test account access controls, or to see if any flaws exist which would allow a potential privilege escalation from within a website or web app. Both blackbox and whitebox penetration tests work within a set framework, generally consisting of four broad phases, network enumeration, vulnerability assessments, exploitation and finally reporting and remediation. Network enumeration aims to pulls as much information about the network as possible using a variety of information gathering tools and techniques. Vulnerability assessments search the information obtained for known flaws and weaknesses, which are then validated where possible using exploits. The final stage and often the most time consuming is the report writing, when all the information obtained is put together in an easily understandable report for the client to read.
Security Audit Systems can provide 5 types of Penetration Tests:
- Website Penetration Testing – For people who wish to test the security of their websites.
- Web Application Penetration Testing – For people looking to test the security of a web application they have developed.
- External Network Penetration Testing – For people that are looking to evaluate the security of their web facing network and services.
- Internal Network Penetration Testing – Also known as Infrastructure Penetration Testing, for people looking to assess their local network security and pinpoint vulnerabilities.
- Mobile App Penetration Testing – for people looking to test the security of their mobile apps.
Why do you need one?
It is an important service that any business with sensitive data on their networks should consider. The information obtained from a penetration test may help prevent security breaches in critical web facing infrastructure, as well as flaws within the local area network. The information can be used to better prepare your business against the ever present threat of cyber attacks. Getting tested may also provide additional intelligence to help complete risk assessments and to seek additional funding when changes need to be made. We have compiled a list of free penetration testing tools however these should only be used if you know what you are doing with them, we highly advise using our professional services when considering a penetration test, please contact us for further information.
How much does it cost?
Costs of a security audit / penetration test can vary considerably, depending on the project size, and often what the clients scope or objectives are. Each test is quoted for once a full understanding of all the aims and objectives from the client have been made clear. Typically a pen test works on a per IP basis, and depending on how many IPs and the potential services operating on the IP, prices can range from £1500-£2500. Bigger companies with multiple IPs that need testing often receive a better price per IP because they are awarding more work to the penetration testing company.
How long does it take?
On average, for a single website or web application assessment it can take one to two weeks, depending on the size of the website this may increase or decrease. Another factor that can affect how long a test takes is how many vulnerabilities we uncover whilst testing. If the target for the test is riddled with security vulnerabilities then it can take longer to test and write up the report. The golden rule when looking to carry out penetration testing is to leave plenty of planning time before (to establish a scope), and after (to fix the detected threats). We get a lot of customers who wish to get the testing done last minute, and forget that they will need to allocate time after the test to implement all the fixes. We always do our best to keep you updated throughout the testing process so you know when you can expect your final report.
Penetration Testing by Security Audit Systems
Ethical hacking, done how it’s supposed to be, using the latest in testing technology and techniques. We are proud to have developed many of our own penetration testing tools, which gives us a competitive advantage when detecting system vulnerabilities. We have access to huge security vulnerability databases and unique private Proof of Concept (PoC) attack frameworks developed by our engineers in-house. We offer both automated and manual testing techniques for all computer platforms. Please make an enquiry to discuss how we can help you meet your security requirements.
Learn more about Penetration Testing
For additional information about our services please call us on +44 (0) 207 0439 349 or contact us to discuss your security concerns or requirements.