Rob Behnke
December 27th, 2021
Security testing is a vital part of an organization’s efforts to protect itself against cyber threats. Companies can undergo a variety of different types of security testing, each with its own areas of focus, pros, and cons. Penetration tests – or pen tests – are one of the most well-known types of security testing. However, penetration tests can be performed in a few different ways to achieve different goals.
A penetration test is a human-driven evaluation of an organization’s cybersecurity posture. Penetration testers will work to emulate how a cybercriminal would attack an organization’s network, chaining various vulnerabilities together to achieve a particular objective.
Penetration tests are very different from vulnerability assessments, which use automated tools to identify vulnerabilities in an organization’s digital attack surface. Penetration tests go further and deeper, enabling them to identify vulnerabilities and attack chains that may not be detectable in a vulnerability assessment. For a deeper dive into what is and isn’t a penetration test, check out this blog post.
Penetration tests are human-driven security assessments, enabling them to be highly customized to meet an organization’s unique needs. This means that penetration tests for different organizations or even evaluating exposure to different threats within the same organization can look very different.
However, penetration tests can be classified into three categories based on the penetration tester’s starting point. These different types of pen tests are intended to emulate different threats to an organization and have their advantages and disadvantages, which we’ll discuss more below.
In a black box pen test, the penetration tester has no access or internal knowledge of the target environment. The pen tester needs to perform their own reconnaissance and identify a vulnerability to exploit for initial access to the environment. From there, the attacker can perform discovery to identify potential vulnerabilities within the target network and determine a means of achieving the objective of the assessment (data breach, ransomware delivery, etc.).
Black box pen testing is designed to most closely emulate a true cyberattack. Most attackers will begin with no access to their targets and will need to plan and execute an attack based upon publicly available information. A black box penetration test is the most effective type of pen test for hardening an organization’s digital attack surface and preventing an attacker from gaining initial access to an organization’s network.
The main limitation of a black box pen test is its scope and complexity. Without any initial access or knowledge of the target environment, the penetration tester may need to spend significant time and resources identifying an initial access vector. This makes it vital to carefully define the goals and scope of the assessment to ensure that there isn’t a tradeoff between the time and quality of the assessment.
Gray box penetration tests provide the pen tester with a greater level of access and knowledge about the target environment. Instead of starting from completely outside, the penetration tester is provided with a legitimate (but usually non-privileged) account and limited knowledge of the enterprise environment. With gray box pen testing, the penetration tester starts out with the same access and knowledge as an average employee.
A gray box penetration test is designed to assess an organization’s vulnerability to insider threats. This form of assessment simulates attacks by a malicious insider or via a compromised account for which the attacker has guessed or stolen the credentials. With widespread poor password security and the recent rapid expansion of remote work, this is a growing threat to many organizations.
In a gray box penetration test, the tester needs to identify methods for leveraging their initial foothold to gain the access and permissions required to achieve the objectives of the assessment. Gray box pen testing provides an organization with an evaluation of its internal network security behind its perimeter-based defenses.
A penetration tester has the greatest level of knowledge and access in a white box assessment. In this form of penetration test, a tester is given full documentation and privileged access to the enterprise network.
The white box pen test simulates if an attacker gains access to a privileged account and is a faster method for performing a penetration test. With full documentation, the penetration tester can spend less time on reconnaissance and discovery and can more quickly identify potential attack vectors that require testing.
The main limitation of white box penetration testing is that the tester’s view of the network is heavily interpreted by that of the internal security team. This documentation and other information describe how the organization’s network and security work in theory, which may be very different from how it works in reality. This difference can lead a penetration tester to overlook security issues where network infrastructure or security controls deviate from the plan.
Penetration tests come in a variety of different forms. They run the gamut from white box tests, where the tester is granted full access and complete knowledge of the enterprise network, to black box tests, which simulate an attacker outside of the network with little or no knowledge of its internals. Penetration tests can also be designed to identify vulnerabilities in specific systems or explore an organization’s vulnerability to particular cyber threats.
All companies can benefit from a penetration test, but it’s important to tailor the assessment to the organization’s unique needs and security goals. To develop a pen testing plan for your organization, reach out to our advanced penetration testing experts at halborn@protonmail.com.