Why is penetration testing important

Question

In improving the security of an organization, it seems as though an audit of existing code, procedures, policies, infrastructure, etc. would be absolutely sufficient to reveal any security or policy deficiencies, and therefore an actual demonstration of that deficiency though a commissioned penetration test would be unnecessary.

What benefit, therefore, does "Red Team" penetration testing provide to an organization beyond the benefit gained though an audit. Furthermore, would there be significant benefit in contracting with a firm to conduct regular penetration tests against an organization in addition to the otherwise scheduled security audits?

Answer 1

Computer Science is just that a Science. It would be very scientific to just hypothesize that you are secure without actually putting it to the test.

You can perform source code analysis and other whitebox testing methodologies to find all sorts of interesting and high impact vulnerabilities... but what if no one could actually exploit these issues? You can't get hacked with an unexploitable vulnerability, yet systems are broken into on a regular basis. (An insider could exploit an issue like this, but that is a different question.)

Penetration testing to me is about using the Scientific Method to try and answer the simple question, "In a real world scenario, what could a hacker do to harm my system or to my company?" To answer this question you get a skilled hacker or team of hackers and purposefully debilitate them by not providing source code or access to the development team. An ideal penetration test is a strictly blackbox testing scenario. Just provide a company name, or an IP address range or even physical address. That is all the all the information an attacker should need. (The CISSP has a section of physical security for a reason.)

At the end of the penetration test you should receive a report with findings. A good penetration test will always have findings. There is no perfect system, everyone can take steps to improve security. From the results of penetration test you can identify weaknesses in your system and it can help you decide how to spend your resources to improve the security of your system as a whole.

Answer 2

One important benefit gained though through red-team testing is that it gives security personnel real experience in dealing with an actual intrusion. The company may indeed have all the important policies in place, but until they actually have to deal with an attacker inside their network, they may not be certain as to how to proceed. Much like a fire drill, a penetration test allows them to develop a working strategy for how to proceed in an otherwise unusual environment.

For example, while a lot of attention is given to the subject of preventing and detecting an outside attack, very little is often proscribed in how to remove an attacker from the network. Without having to deal with this type of event, the security personnel may be left guessing as to the best way to evict the attacker while at the same time protecting the integrity and operation of their critical infrastructure. A real-world attacker could leverage this inexperience to persist his access even after the cleanup is presumbed to be complete.

Answer 3

While in audit my catch many of the same issues as pen-testing, its results are less definitive. While a pen-tester(hacker) my not be skilled enough to access your system, if they are it will be obvious.

I would say the most important difference, however, is mindset. Security teams and auditors tend to examine things from the perspective of making -- they want things to work. In other words they are more inclined to create large unnecessary apparatus; the larger the structure the more vulnerabilities it may contain.

Pen-testers take the opposite approach. They have no interest making a system, only breaking it. They have trained themselves to be alert for any means of access -- including social engineering.

All of this combined gives pen-testers a definite place in security.

As a last point: hacking is about creativity -- out-thinking the security team and pen-testers are more likely to be creative then auditors.

I hope this presents my argument clearly.

Answer 4

Another important aspect which has not been touched upon is cost. So, considering the fact that a company does not have an in-house Software security group, the only way the company can audit their security stature is through Pen-Tests, by hiring consultants specifically for the job. Now, pen-testing will yield results if performed properly. AFAIK, pen testing is the cheapest form of assessing your security standing. There are several apps for static code analysis, true, but the licenses for these applications cost a lot and you would also need a person who can identify false positives.