The Professional Pentester Guide
The demand for information security professionals and experts is rising as there is a huge skills gap! An introduction to aspiring students who want to understand what penetration testing really is and what a penetration tester does.
What is Penetration Testing?
A penetration test, also known in its short form as a “pentest“, is the process that aims to evaluate the security of one or more assets (such as the IT infrastructure, a web application, a mobile application, a software and so on) by running a series of planned attacks with the goal of finding and exploiting vulnerabilities. The areas where a tester could get into a system during a penetration test can be very wide: going from testing the Operating Systems or the appliance configurations to Social Engineering attacks that aim to ‘exploit’ human vulnerabilities. But the penetration test is not only about attacks! A professional pentest includes proper analysis and reporting with the goal of improving overall security.
Job Description of a Penetration Tester
A penetration tester is a professional who conducts the penetration test and creates one or more reports about findings and vulnerabilities, classifies the severity of the risks (high risk, medium risk, low risk) and explains the reasons why these risks are vulnerable. An analysis report is created and delivered to the company, educating executives and the IT department what needs to be done in order to solve the researched security flaws.
As an important note, pentesters do not fix but mainly report the vulnerabilities. They do not change anything in the system, they report the weak spots.
A good pentester provides recommendations and advises the most suitable and cost-effective countermeasures to the vulnerabilities discovered. They can share their ideas on hardware, software and methodologies the company should use, and help ensure the investments done for the company are worth it.
Writing Reports & Communicating Effectively
Reporting is an integral part of this job position. After identifying and classifying the risks of the vulnerabilities, the penetration tester should be able to communicate them on a CEO level – making sure that the report is understandable to the C-Level Management of a company.
Not all of the management of a company speak IT. Hence, the pentester should be able to explain carefully and effectively the risks of these security flaws; avoiding jargon and describing the report to the CEO-level who makes the final business decisions.
Black Hat Hacker, White Hat Hacker, & Penetration Tester Defined
There might be some confusion with the terms used to describe a penetration tester. Sometimes, it is referred to as an Ethical Hacker or a White Hat Hacker. Among these terms, clearly, a penetration tester is far from being labeled as a Black Hat Hacker. To help you understand better, here are the differences.
1. Black Hat Hacker – A Black Hat Hacker only needs to find a single flaw in whichever area in a system, attacks it, and uses the information for personal gain or in bad faith (e.g. stealing information, selling classified data).
2. White Hat / Ethical Hacker – A White Hat Hacker (also termed as an Ethical Hacker) also finds a single flaw in a system, but uses the information to help improve the system (e.g. reporting the flaw to the company).
3. Penetration Tester – A Pentester has to find ALL flaws in a system, write them down, create a report, and include details on how the hack was executed and how it can be replicated.
Hackers (whether Black Hats or White Hats) only need to find one vulnerability flaw and they attack everywhere. How they use the discovered vulnerability is what differentiates one (White Hat = Good) from the other (Black Hat = Bad).
Penetration Testers, on the other hand, are the most-skilled compared to Black Hat Hackers or White Hat Hackers as they need to find ALL vulnerabilities. The scope of penetration testers is focused on a particular area in a system/network/application, yet they have to scan all possible doorways.
Think Like A Hacker To Catch One
A penetration tester needs to think like a hacker and use many of the same techniques that a hacker does. But unlike hackers, a penetration tester works under strict rules of engagement – you go into specific areas only, and have limits on your actions. A hacker simply needs to find ONE way into a system, a Pentester has to find all or most of the possible vulnerabilities. The purpose is to discover weaknesses, not break into the system for its own sake.
Interested to become a professional penetration tester or boost your current pentesting skills with practical know-how? We have the perfect opportunity for you, as we are launching the Penetration Testing Professional training course version 5 later this month. Register for the PTPv5 live launch webinar to see the full syllabus, take part in an exciting live demonstration… and to have a chance of winning this course 😉 Every attendee can claim a free PTS training course.
Register for PTPv5 Launch Webinar HERE.
Author: Marine D.
Patience, persistence, and perspiration make an unbeatable combination for success. 😉
Leave a Reply