What does a pentest do?

If you are building a cloud-based business or migrating information assets to the cloud, you’re taking a giant step towards improving operational efficiency and cutting costs. However, most of the third party plugins or applications you use to do this will be operating from the cloud.  

Cloud providers are subject to certain security regulations, and will have some policies in place to safeguard your data privacy. But this isn’t always enough, which is why you need to know about penetration testing – otherwise known as pen testing. 

What is a pen test?  

A pen test, sometimes referred to as ethical hacking, is an authorised simulated cyberattack carried out on your computer systems that’s performed to identify vulnerabilities that could be exploited. Penetration testing is an effective and proven way to find and fix security weaknesses before your systems are hit by a cyberattack. 

Pen testing is often confused with a vulnerability assessment, but they are not the same, although a vulnerability assessment is one of the five phases of a penetration test. 

Cloud pen testing is a way of detecting and exploiting security vulnerabilities in your cloud infrastructure through a controlled mimicked cyberattack. Penetration testing cloud infrastructures is carried out under strict guidelines from cloud service providers, like AWS and Microsoft Azure, among others. 

There are 5 to 7 phases of pen testing depending on the scale of the process: 

1. Reconnaissance 
2. Scanning 
3. Vulnerability Assessment 
4. Exploitation  
5. Post Exploitation 
6. Reporting 
7. Re-audit 

A lot of data is generated during pen testing processes, like vulnerabilities, open ports, vulnerable IP, and it’s challenging to keep track of it all. This explains all the different phases, which help you to manage the data and take the necessary actions in each phase. 

Why is pen testing needed and when should penetration testing be performed?

With more companies transferring information to the cloud, cyberattacks are an increasingly big threat to data privacy. Pen testing is a preventative measure, and is crucial to your organisation’s data security. Plus, it’s a way to help your business understand and tackle any type of security breach from a malicious party. 

According to a 2022 IBM report, featuring research by the Ponemon Institute, at least 550 data breaches across 17 countries and 17 industries were reported. The research shows that the average cost of data breaches increased from $4.24m in 2021 to $4.35m in 2022. 

The top attack vectors, according to the IBM report, include:

• Stolen or compromised credentials – responsible for 19% of breaches
• Phishing – attributed to 16% of breaches
• Cloud misconfiguration – causing 15% of breaches 

This is why pen testing is more relevant than ever. It serves as a way to analyse whether your company’s security policies are genuinely effective. Think of penetration testing as your cybersecurity fire drill. 

Pen tests not only help to identify solutions to detect and prevent attacks, but enable your organisation to eject malicious hackers from your system in an efficient way. 

Here are some examples of when pen testing should be performed:

• When upgrading or changing your organisation’s IT infrastructure or applications in any way
• When relocating to new office space 
• When applying new security patches
• When modifying end-user policies 

It’s important that you don’t make the mistake of performing a pen test too early. If you are currently deploying a new system or network, changes occur constantly. Performing a pen test at this stage might fail to catch potential future security vulnerabilities. 

In general, you should perform a pen test right before your system is put into production – once the system is no longer in a state of constant change. Unfortunately, many organisations fail to adhere to this recommendation. Why? Because they are in a rush to see a return on their investment. 

Pen testing is not a one-time task. Networks and computer systems rarely stay the same for long. New software is often launched, other changes are made, and these must be tested or retested. How often you engage in pen testing will very much depend on: 

• The size of your company
• Your budget 
• The regulations, laws and compliance requirements of your industry
• Your infrastructure 

Taking your infrastructure as an example, you might have a 100% cloud system, but you might not be allowed to test your cloud provider’s infrastructure. Your provider might already conduct pen tests internally. 

According to the 2022 Pen Testing report, 42% of cyber professionals run pen testing once or twice a year. 

How is a pentest performed? 

A pen test is performed using the 5 to 7 phases you saw earlier. However, there are different types of penetration testing styles depending on how much information your organisation is willing to share. The information you share will have a huge influence on pen testing outcomes. 

Pen testing styles will generally be defined as:

• White box
• Black box 
• Grey box 

White box pen testing 

Sometimes referred to as ‘crystal’ or ‘oblique’ box pen testing, white box penetration testing involves giving full network and system information access to the tester. This includes your network maps and credentials. White box pen testing helps to save time and cut the overall cost of engagement. This type of testing is ideal for simulating a controlled, targeted attack on a specific system using as many attack vectors as possible. 

Black box pen testing 

This type of test doesn’t require you to provide information to the tester. In this scenario, the pen tester assumes the role of a malicious attacker, from gaining initial access to your network or system, through to exploiting vulnerabilities.  

Black box pen testing is considered the most authentic way to expose vulnerabilities by demonstrating how an attacker, with no inside knowledge of your organisation, can target and compromise your network or system. The drawback to this type of testing is that it tends to be the most expensive. 

Grey box penetration testing 

Also known as ‘translucent’ box testing, grey box pen testing requires your organisation to provide only limited information to the tester. Typically, this means providing login credentials. This type of testing is particularly useful for helping to understand how an attacker could gain access and the potential damage they could cause. 

Grey box pen testing is considered to strike the right balance between depth and efficiency, with the option to simulate an inside threat or an external attack.

Tilaa Cloud: Safe & Secure

Tilaa places great importance on data security and data sovereignty. We are convinced that personal data, as well as data in a business context, is extremely valuable. That is why we ensure quality and safety by certifying our processes and services in accordance with internationally recognised standards. 

Our entire set of processes and procedures is monitored and tested by multiple external parties and improved continuously. This includes regular as well as ad-hoc (pen)testing of our services. Learn more about our network and certifications on our Safe Cloud page.