Almost all agree that during a pentest it is impossible to guarantee the integrity of the target (Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?) because you are going to use unexpected input and automatic tools to see its response.
In this scenario, is it reasonable to perform a pentest over a critical infrastructure? The integrity of a critical infrastructura may be needed to protect human lifes and its malfunction put human lifes at risk.
How can we perform a security test over a critical infrastructure knowning its criticality?
Possible solutions to this problem are:
1) Perform a theoric audit
Theoric audits are ok but will have theoric results not real results.
2) Perform a pentest over an identical environment
When we talk about critical infrastructures (and for other environments as well) may be impossible to have two identical environments because the cost and the complexity of the environment.
When we talk about critical infrastructures we talk about things like:
- electricity generation, transmission and distribution;
- gas production, transport and distribution;
- oil and oil products production, transport and distribution;
- water supply (drinking water, waste water/sewage, stemming of surface water (e.g. dikes and sluices));
- agriculture, food production and distribution;
- heating (e.g. natural gas, fuel oil, district heating);
- public health (hospitals, ambulances);
- transportation systems (fuel supply, railway network, airports, harbours, inland shipping);
- financial services (banking, clearing); security services (police, military).