-: Another method of testing the security
of your network is to conduct a penetration test.
A penetration test is conducted by
a team of professionals to simulate
an attack on your network, it's system,
or it's applications.
Often, this is called a pen-test.
And the idea here is for the team
to break into your network, just like a real hacker would.
But, how does a penetration test differ
from a vulnerability assessment?
Well, vulnerability assessments are conducted
often as a credentialed scan,
where the tool can be provided
with a username and password for the systems.
This is going to provide you
with an inside out look of your networks,
just like a system administrator would see.
Now, instead, a pen-test is seeking
to look at your networks as an attacker would,
from the outside in.
Often, your penetration tests are going to be
conducted in the form of a black-box test,
where the pen-testers have to hunt for any information
that they need in order to be able to penetrate
the network's defenses.
But some organizations are going to hire
a pen-testers to perform the assessment
as a white-box test instead.
This means they'll give them
some kind of information about the network,
usually IP addresses, the types of servers being run,
maybe the software, and sometimes even a basic
standard user account.
Now, it really depends on how much time and money
you want to dedicate to an assessment as to whether
you're going to start from scratch and do a black-box
assessment or save some time and money
by starting with a white-box assessment.
Now, during a penetration test, the simulated attackers
are going to bypass your firewalls, find vulnerabilities
in your network and attempt to break through your defenses.
After the test is complete, you're going to get
a full report provided to the organization
so that you can start patching and fixing
all of the things they found.
These tests can be conducted by a simulated attacker
from the command prompt using basic tool sets
or solutions, things like Metasploit, CANVAS,
and other pen-testing tools.
Like a vulnerability assessment, penetration tests
are a snapshot in time.
As such, they need to be conducted periodically
to determine the true effectiveness
of your defenses.
A penetration test can also determine
if your employees are actually following
the sound principles of IT security
that you taught them during their annual user training
by attempting to trick them with phishing emails
and other social engineering attacks.
Penetration tests follow five basic steps.
First, you get permission and you document
information about the target network.
Second, you gather information about the target
through reconnaissance.
Third, you're going to enumerate the target
to identify known vulnerabilities.
Fourth, you're going to exploit the network
to gain user or privilege access.
And fifth, you're going to document
all of your results of the pen-test
and give that report to the organization.
Now, pen-testers can use a wide variety
of techniques and attack methods,
just like a real hacker would.
A pen-tester is going to attempt to break into the network
and gain at least an initial foothold
into the network.
For example, if I was your pen-tester,
I might use a phishing campaign
to try to phish your users within your network.
If I can get them to click on a link,
that might let me access a system as that user.
Then, I would want to elevate my permissions
up to the administrator level, if I can.
If not, I'm going to want to pivot to another user
or another workstation.
By pivoting, I can continue to spread out
across the network and chain my attacks together.
This is going to help me to establish persistence
as the pen-tester because now I have the ability
to maintain my foothold inside your network.
Even if that first user account I broke into
is figured out and they change the password,
I now might have many other accounts
throughout your network that I can use
and still pivot around the network,
finding more vulnerabilities.
While pen-tests often come across from
an external network like the internet,
you can also run pen-tests from within your network
if your organization desires.
This would be dependent on the scope of the assessment.
For example, if you wanted to assess
the damage that an insider threat could perform,
you could do this by hiring a pen-tester,
having them come into your organization,
giving them a standard username and password,
and putting them at one of your workstations.
And then seeing what kind of damage they could do.
Now, pen-testing is an entire course onto itself.
In fact, it's called PenTest+.
So, we're not going to cover everything here in this lesson
or even in this course.
If the idea of being a pen-tester excites you,
I recommend you check out the PenTest+ certification
from CompTIA as your next course of study
once you finish Security+.
Whereas Security+ is designed as a fundamental
security certification for beginners
that gives you a really wide range of ideas
of security, PenTest+ is designed for people
who have been working in cyber security
for at least a year or two.
It's considered an intermediate level
certification that's offered by CompTIA,
and passing the PenTest+ will automatically
renew your Security+ certification
for an additional three years, too.
So, it's a great second course for you to take.