What Does a Penetration Test Really Tell You?

Penetrationtesting is one of the essential elements neededto gain insight into your currentcybersecurityposture. Itenablesyouto identify how you may be susceptible to unknownweaknessesthat external parties may be able to exploit.Making the decision to have a penetration test done to your network is a great first step. Understanding what having the test done will show you, is one step further.

A penetration test is the best representation of how your network appears to potential attackers. These tests simulate a real network attack using the security shortcomings (if there are any) that are currently present in your systems. A penetration test is a 5-step process that involves reconnaissance, enumeration, vulnerability analysis, exploitation, and reporting. Following this, testers are able to document the steps taken to access the system and provide real insight on how the network appears to potential hackers.

That is great, but what does the report tell me?

First of all,it’s important to know that penetration testsand vulnerability assessmentsare not the same. Your final report on your penetration test should include a narrative of how the penetration testers, also known as an ethical hacker,executed the testing, detailing how vulnerabilities were identified and exploited.

This isnot a report of your vulnerabilitiesthat were identified through automated scans. If you receive a document with hundreds of pages listing patch-based vulnerabilities, that isthe results of a vulnerability assessment, not a penetration test.The penetration test could exploit unpatched vulnerabilities, which is one of the goals of the test; however, it should also help you assess your network configuration and setup to determine what information could potentially be exploited. Having a penetration test should be viewed as a great way to engage IT teamsto enable them to understand where the network infrastructure can be improved.

This report shouldnot be a sales pitchto purchase more hardware.If you are prudent with updating your technology, it is highly likely that youalreadyhave spent moneyfor the proper equipment to secure your IT infrastructure. The penetration testing will ensure that your money was well spent, and your environment has been configured to appropriately leverage that technology. The penetration testing report should also help you to assess whetherthe penetration pointsareable to be fixed with the currenttechnologyyou have in place, and may even result in identifyingboth long- and short-term solutions to fix the penetrable points.