1

According to me, The key here is to use virtualization. This is a main precaution that allows safe handling (isolation) of systems that could otherwise be exploited and leveraged as jump points into an organization infrastructure.

  • If you are considering attacks where unavailability or loss of integrity may be experienced at the moment of testing and you have future plans of improvement depending on your budget(like backups and load distribution) then you may consider signing a deal mentioning the conditions and scope. Penetration tester only exploits the infra for sake of proving the impact of the existing vulnerability which sometimes facilitates better analysis of risk and plan of action post exploitation. – Arpit Rohela May 12 at 6:43
  • 1
    What type of pentest are you talking about? For network tests, virtualisation doesn't apply. – schroeder May 12 at 9:21
6

The point of a penetration test is to test a company's actual infrastructure as if the pentester were a real attacker. This way, the penetration tester can find security issues that the company has been unable to find by itself. Pentesters oftentimes find "bugs" in things that aren't software: some test physical security and social engineering as well.

While hacking into virtualized systems that are separate from the organization's actual infrastructure might be useful, it isn't a penetration test in the traditional sense.

Since the penetration tester is being paid by the organization they're hacking into, they're not going to do something that would actually harm the organization. Once they find a foothold into a system, they might exploit it and continue further inside the organization's infrastructure. However, they won't actually steal data or install malware like a real hacker would. The pentester usually has a contract that prevents them from being sued if something bad happens, but they'll still do their very best to avoid causing actual damage.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.