Cybersecurity: Ensure IT security via penetration testing

IT system security is gaining in importance as digitalization advances and cybersecurity becomes more relevant. A key way to check your own systems for weaknesses is penetration testing, the technical term for carrying out a comprehensive security test on individual computers or networks. Cybersecurity has reached the boardroom and is now a hot topic in many companies.

Overview

Definition of penetration testing

Penetration testing is a comprehensive examination of the IT systems or networks of companies, public authorities, and other organizations to determine their vulnerability to potential attackers. A special feature here is that all methods and techniques could also be used by real, unauthorized attackers. The goal is therefore to diagnose system security under real conditions.

Why use a penetration test?

Penetration tests are useful for a wide range of systems and applications and protect data, strategies, and much more within companies. They can identify vulnerabilities and better assess potential risks.

The focus is on protecting important systems more effectively. Organizations have relied on digital infrastructure for years, and that infrastructure has to be protected, or would you publicly present documents about company goals and strategies to the competition?

A penetration test is comparable to testing whether your company headquarters is sufficiently protected, or whether potential thieves would have an easy time breaking in. One major difference is that hackers usually do not have to be on site to steal sensitive data, and they have far more ways to infiltrate systems and networks unnoticed.

Because threat patterns and security-relevant factors in IT are constantly changing, companies must understand a penetration test as a snapshot. Extreme cases show that companies can remain vulnerable even immediately after a penetration test and the remediation of risks if new security gaps appear. Continuous, iterative strengthening of security measures and closing of gaps is essential.

Types of penetration tests

There are many different types of penetration tests. These include different target areas such as IT infrastructure or web applications, as well as classifications such as black-box or white-box penetration tests.

IT infrastructure penetration test

This category includes testing server systems, firewalls, WLAN networks, VPN access, or firewall configurations for security vulnerabilities.

Web application penetration test

Web applications are interactive applications accessible through the web. In most cases, they can be used through a browser. A characteristic of a web application is that users can interact with the system across platforms. Testing focuses on issues such as access-control errors, information leaks, or weaknesses in the web software.

Black-box penetration test

In this case, the tester does not know which systems and security measures to expect. They have no knowledge of the IT infrastructure. The tester therefore has to proceed just like a hacker and build their own picture of the infrastructure.

White-box penetration test

This is the exact opposite of a black-box penetration test. Here, the tester knows everything about the IT infrastructure: which servers, operating systems, services, and applications are running, and which ports are open or should be open. Because the tester has all the information, effectiveness is much higher than with a black-box test. Testing can be focused precisely on the known systems, and the gap between target and actual IT security becomes most visible.

Of course, there are further types of penetration testing. Since these tests are tailored to the specific needs and objectives of companies and the goals of the authorized attack, they can be expanded individually. Companies can therefore decide for themselves which type of penetration test should be carried out.

Goals of a penetration test

The reason for a penetration test is either existing concerns about the usefulness of the security systems in use or the simple and appropriate need for caution. In general, companies should prefer to carry out several tests rather than just one, because the damage caused by unauthorized attacks is usually many times greater than the cost of a test.

In summary, the goals of a penetration test can be divided into three points:

1. A central point is, of course, the identification of vulnerabilities, meaning the recognition of potential risks in the company’s security system.
2. Building on that, potential errors resulting from employees’ incorrect use of devices and software are of great importance. Attackers often obtain login details through links to fake websites and can then access company networks.
3. Another goal is the confirmation of IT security by an external third party and the early detection of potential dangers. External execution of the test is often recommended because it is more objective and avoids conflicts of interest.

These goals are often followed by the remediation of the diagnosed vulnerabilities, although that is not necessarily part of the penetration test itself. This is often done through new security systems and measures that prevent intrusion. Training for employees is also part of this, since employees are often the first target of an attack.

If these goals are not met, companies can suffer severe damage, because preventing such attacks is extremely important. Long outages and system disruptions not only make employees’ work harder, but also send a bad signal to customers. That is why the goal should be to reduce risks in advance so that you can respond quickly and effectively to potential disruptions or attacks.

How does a penetration test work?

Penetration tests can be divided into five steps, covering the entire process from the beginning of the collaboration to the final tests.

1. START - At the beginning, the organization has a detailed discussion with the company performing the penetration test about the objective of the test. It is important to consider the legal aspects of such a test. These include, for example, the fact that no IT systems or networks belonging to third parties may be tested. It is therefore important for the client to clearly define the systems to be targeted.
2. TEST - The second step is the execution of the test. Here, systems are attacked in the same way that potential attackers would do it. In practical terms, that means all areas such as (W)LAN, cloud systems, or IP ranges are tested.
3. DOCU - Complete documentation is crucial during the test. This means that both the way the test was carried out and the systems under attack, as well as their ability to defend themselves, are documented. This is important because the client and the provider then discuss the vulnerabilities and the possibilities for better protection.
4. SHOW - In a follow-up meeting, the discovered vulnerabilities and the resulting mitigation measures are presented based on the documentation. Implementing IT hardening measures is not part of the penetration test itself, but naturally follows after vulnerabilities are found.
5. RETEST - IT security upgrades are usually followed by at least one, and often several, retests that analyze network security after protective systems have been upgraded. While classic bank vaults may face 15 potentially dangerous situations, the digital age offers thousands of ways to attack a system and steal valuable data. It is therefore important to understand that there is no complete protection against cyberattacks, but that their impact and frequency can be reduced through continuous improvements to the security system.

Legal framework

Of course, before a penetration test is carried out, there must be a contract between the client and the provider that covers the core points of the test. Without such an agreement, penetration tests are illegal and may constitute a criminal offense. It is important for both sides to ensure that the test only relates to objects that are under the actual control of the organization being tested. This means that no IT systems or networks belonging to third parties may be tested, even if they also pose a security risk.

Services used by companies, different software solutions, or cloud services make it difficult to clearly separate what may and may not be tested. It is therefore important to plan such a test thoroughly in advance and, where necessary, obtain consent declarations. If exactly those external systems represent a security risk, it may be worthwhile to separate from them, or at least secure the digital infrastructure, of those third parties.

Outlook 2021

Cybersecurity continues to gain importance year after year. The technological interconnectedness of systems and networks creates new risks, while at the same time giving potential attackers more and more ways to penetrate systems. In its Digital Trust Insights 2021, the auditing firm PwC provided an outlook for 2021 and beyond. The survey interviewed 3,249 executives from business, technology, and security between July and August 2020.

According to the survey results, 98% of companies changed their cybersecurity strategy as a result of COVID-19. The COVID-19 pandemic has become a catalyst for digitalization and mobile office work. Depending on how long-lasting the effects of the pandemic are, these changes will likely become permanently embedded in organizations. At the same time, just over 50% of companies plan to further increase their cybersecurity budgets in 2021, according to the survey. What is clear is that cybersecurity has reached the boardroom. Already, 59% of CEOs want to work closely with their Chief Information Security Officer (CISO) to increase their company’s resilience.

Are you interested or do you have questions about system security in your company, or are you planning IT projects to evaluate your cybersecurity? Feel free to contact us without obligation. We would be happy to advise you and put you in touch with selected experts.