SIX STAGES OF TESTING

First, Right Hand defines the scope and goals of the test, including the systems to be addressed and the testing methods to be used.

The next step is to understand how the target application will respond to various intrusion attempts. This is typically done using either Static Analysis (inspecting an application’s code to estimate the way it behaves while running) or Dynamic Analysis (inspecting an application’s code in a running state).

This stage uses web application attacks to uncover a target’s vulnerabilities and then exploit them. The attacks may include DoS or denial-of-service, (making a machine or network inaccessible to intended users), cross-site scripting (injecting malicious code into a vulnerable web application), SQL injections (using malicious SQL code for backend database manipulation to access information not intended to be displayed), or backdoors (malware that negates normal authentication procedures to access a system).

The goal of this stage is to see if the vulnerability can be used to achieve a persistent presence in the exploited system—long enough for a bad actor to gain in-depth access. This stage imitates an advanced persistent threat, which can stay active in a system for prolonged periods to steal sensitive data and cause further damage.

The results of the penetration test are compiled into a report detailing the specific vulnerabilities exploited, the sensitive data accessed, and the length of time the tester remained in the system undetected. This information is then used to patch vulnerabilities and protect against real future attacks.

Once the testing is complete, all traces of tools and processes used during the previous stages are removed to prevent a real-world threat actor from using them as an anchor for system infiltration. During this stage, remediation begins on any issues found in a company’s security controls and infrastructure.