Full Definition
What is Penetration Testing?
Penetration testing (pen testing) is an authorized simulated attack on a computer system to evaluate its security. The test identifies vulnerabilities, validates security controls, and provides evidence of potential business impacts from successful attacks.
Types of Pen Tests
By Knowledge Level
- Black Box: No prior knowledge
- Gray Box: Partial knowledge
- White Box: Full knowledge and access
By Target
- Network penetration testing
- Web application testing
- Mobile application testing
- API testing
- Social engineering
- Physical security testing
Testing Methodology
1. Planning & Reconnaissance
- Define scope and rules of engagement
- Gather intelligence (OSINT)
- Identify potential targets
2. Scanning & Enumeration
- Port scanning
- Vulnerability scanning
- Service identification
3. Gaining Access
- Exploit vulnerabilities
- Bypass security controls
- Establish foothold
4. Maintaining Access
- Persistence mechanisms
- Privilege escalation
- Lateral movement
5. Analysis & Reporting
- Document findings
- Risk assessment
- Remediation recommendations
Compliance Requirements
Many frameworks require pen testing:
- PCI DSS (annual + after changes)
- SOC 2 (common criteria)
- HIPAA (risk assessment)
- ISO 27001 (Annex A)