Penetration testing, which is also referred to as ethical hacking, tests a system’s defense against attacks, and performs a detailed analysis of the system’s weaknesses. A penetration test can also be applied to ascertain what happens when the system goes into reaction-mode to an attack and what information can be collected from the system. The three types of penetration tests are:
- Full Knowledge Test: The penetration testing team has the most extensive knowledge possible about the system to be tested. This test will replicate a certain attack that might be tried by an informed employee of an organization.
- Partial Knowledge Test: The penetration testing team has knowledge that might have relevance to a specific type of attack.
- Zero Knowledge Test: The penetration testing team comes in with no information about the system and must collect the information which is part of the testing process.
The next step is to simulate an attack by a would-be hacker that has no prior knowledge of the information system. Penetration testing is often described as being either white box or black box testing. With white box testing, the penetration testing team has access to the internal system code. This allows them to go in with more knowledge and more specifically target weaknesses in the known code. In closed-box testing, the penetration testing team does not have access to internal code. This testing simulates an attack from someone with no knowledge of the internal system. This results in tactics / attacks that are much more general and involve enumerating what may be inside the system.
