In recent years, information is being exchanged at an unprecedented rate, and companies are always looking for a way to safeguard their digital data. They are often looking for ways to understand whether or not their systems are secure enough to withstand an attack. To find potential security holes (vulnerabilities) and determine the likelihood of potential compromise, they perform penetration testing. They do so by either having an internal team of skilled employees or by hiring a consultant.
What Is a Penetration Testing?
For this article, penetration testing will be defined as a manner in which a security professional is trying to exploit a vulnerability in an environment by taking offensive action against it (Abernathy & McMillan, 2018). They are classified based on the amount of information shared with the testing team and can be found in 3 main categories. Figure 1 illustrates some types of penetration testing strategies (ibid).
This article will focus mainly on two types of testing, black box, white box, and the difference between them.
What is Black-Box Penetration Testing?
According to Chapple, Stewart, and Gibson (2018), with black box penetration testing, the testing team has no prior knowledge about the target. No information is provided: this test is also often referred to as a closed test. Due to this, the tester is forced to approach it in the same manner that a real hacker would, leaving them with little ability to prepare as they do not possess any internal diagrams or any additional information besides those that are publicly available. In addition to that, the lack of knowledge also means that these tests tend to take less time than other types of penetration testing. However, the time spent relies heavily on the hacker's ability to find and exploit vulnerabilities and the security of the perimeter.
Another key point that is important to mention about black-box testing is that it depends upon the dynamic analysis of current systems and running programs in the target network.
One of the major drawbacks of these tests is if the hackers/penetration tester fails to identify and exploit any vulnerability, internal vulnerabilities might go unnoticed, which subsequently will lead to the system being unpatched (ibid).
What is White Box Penetration Testing?
White box penetration testing is the opposite of black box; with this approach, the testers have upfront access to all of the information related to the target, from network diagrams to application source code. The tester has a clear picture of the organization that they are conducting the test against based on the provided information/documentation. Several names are used to denote white box testing, including glass door, open box, and clear-box(Khan, 2011).
No matter the test case that the penetration tester is running, the overall goal of a white-box penetration test is to acquire as much information as possible ahead of the test. The tester attempts to collect as much feedback as possible so that they get extra awareness and, ultimately, comprehend the system to further elaborate their penetration tests.
The amount of information shared with the testing team often provides the perfect opportunity for them to bypass certain steps of the reconnaissance phases that precede the attacks and increase the probability that the attacker will find security flaws (ibid).
Take the "Penetration Testing and Ethical Hacking" Certification Course >>
Making a Decision
Each method has its own set of advantages and disadvantages. Table 1 provides a back-to-back comparison between the two.
Conclusion
In summary, the purpose of a penetration test is to allow a security team to make your system, application, or network more secure based on the results. There are many ways that this can be accomplished, either by having internal security or hiring a consultant that will work closely with the company to identify the best approach that fits the organization's needs (Abernathy & McMillan, 2018).
Bear in mind there is no right or wrong decision for choosing a type of penetration testing. It depends on the scenarios one is looking to test and what one feels will make most of one's resources. The difference between them is basically how much information is shared with the testing team before the beginning of the test.
Whether an individual chooses a black box or white one, it is all about how much sense it made to their organization at the time of the decision in terms of budgeting, timing, and other resources available or what they are trying to accomplish with either one of them.
References
- Abernathy, R. and McMillan, T. (2018) CompTIA Advance Security Practitioner. Person Education.
- Chapple, M., Stewart, J.M., and Gibson, D. (2018), Certified Information System Security Professional Official Study Guide. Edition 8th. John Wiley & Sons
- Choudary, A. (2020) What Is Penetration Testing Methodologies and Tools Available[Online] at: https://www.edureka.co/blog/what-is-penetration-testing/
(Accessed: 08 July 2020) 4. Khan, M. E. (2011) Different Approaches to black box testing technique for finding errors. [Online] at: https://www.researchgate.net/publication/268419508_Different_Approaches_To_Black_box_Testing_Technique_For_Finding_Errors (Accessed: 04 July 2020)
