What Does a Penetration Tester do?

What Does a Penetration Tester do?

Netragard Penetration Testers

What Does A Penetration Tester Do?

Penetration testers are one of the most sought-after roles in the cybersecurity field.  However, there are a lot of misconceptions about what a penetration tester actually does from day to day. It’s important to understand what a penetration tester actually does. Whether from the side of an aspiring penetration tester or someone looking to bring one in to assess a company’s security.

A Day in the Life of a Penetration Tester 

Penetration testers assess the security of an organization’s systems via a combination of automated and hands-on testing.  By using the same tools and techniques as a real attacker, a pentester provides a realistic assessment of an organization’s exposure to cyber threats and the vulnerabilities most likely to be exploited by an attacker. 

Pentesters have a variety of different duties, and a typical day may contain a mix or a focused effort in a particular area.  These are some of the core tasks that a penetration tester performs. 

Planning (and more planning)

Penetration tests are not free-for-alls where the tester throws everything that they have at a target system.  Such an attack would pose a significant threat to the stability of the customer’s systems and their ability to continue operating during the engagement. 

Often, pentests are targeted exercises in which the customer and tester agree on the scope of the assessment, allowable tools and techniques, and other rules of engagement.  All of these terms must be worked out and agreed upon before the testing can begin. 

Assessment 

When most people think of pentesting, this is what they think of.  After planning is complete and all of the agreements are signed, the tester performs their evaluation of an organization’s systems. 

A pentest is designed to emulate a real-world attack, so pentesters move through many of the same attack stages as a true cybercriminal.  These include the following: 

  • Reconnaissance: Learning about the target and identifying potential avenues of attack. 
  • Scanning: Port scanning and vulnerability scanning are automated processes that help identify potential vulnerabilities for exploitation. 
  • Gaining Access: After identifying a vulnerability, the tester exploits it to gain access.  This could include exploiting a vulnerability, sending a phishing email, or other tactics. 
  • Maintaining Access: Pentesters and attackers rarely immediately gain the access that they need for an attack.   
  • Achieving Objectives: Pentests commonly have predefined objectives to demonstrate success, such as planting a flag on a particular server.  Once the pentester has established a foothold, they can work to achieve these objectives. 

During the course of a pentest, a pentester may undergo multiple iterations of these stages.  For example, an initial attempt at exploitation may fail, making additional reconnaissance necessary, or the tester’s initial foothold may lack access to the target system, forcing another attempt. 

Reporting and Presenting 

Penetration tests are a service provided to a customer to help identify vulnerabilities in the customer’s environment.  If a pentester performs an assessment but doesn’t communicate the results clearly to the customer, then the assessment was a failure. 

The reporting stage of an assessment involves the pentester describing what they did, what they found, and the implications of these findings.  A penetration test always involves a written report, but commonly also involves a live presentation to the customer describing the findings.   

Reporting is the most important stage of the pentest, so a tester will commonly spend significant time during and after the assessment creating and presenting the report. 

Research and Development 

A penetration test should provide a realistic simulation of a real cyberattack against an organization.  However, the cyber threat landscape is constantly evolving as new tools and techniques are developed and used in real-world attacks. 

A penetration tester will need to perform frequent research, training, and development to keep their skills up-to-date.  Doing so periodically ensures that they are capable of simulating the latest types of attacks. 

Reality of Pen Testing

A penetration tester performs a great deal of work before, during, and after the actual assessment. They conduct tests and purposefully, attempt to exploit existing computer systems and software to detect and correct system weaknesses. Once completed, the test and findings are carefully documented in a report which is provided to the client.  

Interested in penetration testing? Check out Netragard’s competitive benefits and open positions.  

Penetration testing is the best way for organizations to measure their cyber risk exposure and identify potential vulnerabilities before they can be exploited.  For more information or to schedule your organization’s next pentest, contact us. 

Blog Posts

Karen Huggins

Chief Financial, HR and Admin Officer
Divider
Karen joined the Netragard team in 2017 and oversees Netragard’s financial, human resources as well as administration functions. She also provides project management support to the operations and overall strategy of Netragard.
 
Prior to joining Netragard, she worked at RBC Investor Services Bank in Luxembourg in the role of Financial Advisor to the Global CIO of Investor Services, as well as several years managing the Financial Risk team to develop and implement new processes in line with regulatory requirements around their supplier services/cost and to minimize the residual risk to the organization.
 
With over 20 years of experience in finance with global organizations, she brings new perspective that will help the organization become more efficient as a team. She received her Bachelor of Finance from The Florida State University in the US and her Master of Business Administration at ESSEC Business School in Paris, France.

Philippe Caturegli

Chief Hacking Officer
Divider
Philippe has over 20 years of experience in information security. Prior to joining Netragard, Philippe was a Senior Manager within the Information & Technology Risk practice at Deloitte Luxembourg where he led a team in charge of Security & Privacy engagements.

Philippe has over 10 years of experience in the banking and financial sector that includes security assessment of large and complex infrastructures and penetration testing of data & voice networks, operating systems, middleware and web applications in Europe, US and Middle East.

Previously, Philippe held roles within the information system security department of a global pharmaceutical company in London. While working with a heterogeneous network of over 100,000 users across the world and strict regulatory requirements, Philippe gained hands-on experience with various security technologies (VPN, Network and Application Firewalls, IDS, IPS, Host Intrusion Prevention, etc.)

Philippe actively participates in the Information Security community. He has discovered and published several security vulnerabilities in leading products such as Cisco, Symantec and Hewlett-Packard.

He is a Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), PCI Qualified Security Assessors (PCI-QSA), OSSTMM Professional Security Analyst (OPSA), OSSTMM Professional Security Tester (OPST), Certified in Risk and Information Systems Control (CRISC)and Associate Member of the Business Continuity Institute (AMBCI).

Adriel Desautels

Chief Technology Officer
Divider
Adriel T. Desautels, has over 20 years of professional experience in information security. In 1998, Adriel founded Secure Network Operations, Inc. which was home to the SNOsoft Research Team. SNOsoft gained worldwide recognition for its vulnerability research work which played a pivotal role in helping to establish today’s best practices for responsible disclosure. While running SNOsoft, Adriel created the zeroday Exploit Acquisition Program (“EAP”), which was transferred to, and continued to operate under Netragard.
 
In 2006, Adriel founded Netragard on the premise of delivering high-quality Realistic Threat Penetration Testing services, known today as Red Teaming. Adriel continues to act as a primary architect behind Netragard’s services, created and manages Netragard’s 0-day Exploit Acquisition Program and continues to be an advocate for ethical 0-day research, use and sales.
 
Adriel is frequently interviewed as a subject matter expert by media outlets that include, Forbes, The Economist, Bloomberg, Ars Technica, Gizmodo, and The Register. Adriel is often an invited keynote or panelist at events such as Blackhat USA, InfoSec World, VICELAND Cyberwar, BSides, and NAW Billion Dollar CIO Roundtable.