To start off we need to define penetration testing. What is it?
What is a penetration test?
Penetration testing (sometimes called a pen test) can be extremely useful in finding vulnerabilities in your organization’s cybersecurity protection. Basically, a team of experts attempts to “penetrate” your defenses, as if they are a bad actor, who actually wants to steal your data. If you’ve heard the term “ethical hacking” before, this is one of the ways that it is done. Think of it as hiring a hacker to conduct a simulated cyber attack in the form of a penetration test.
Through this process, your weaknesses can be identified and methods to shore up defenses will be recommended. Typically, it’s a good idea to do some type of penetration testing annually, to make sure that your systems are holding strong against the latest forms of cyberattack. You can do this yourself with online penetration testing tools, or you can hire a third party who will perform a more thorough test for you, and help you effectively respond to the results.
Why is penetration testing important?
Cyber attacks are on the rise. Technology is more widespread than ever before in our culture and our world —especially in our more remote hybrid workspace— and as a result, we rely more and more on it. Can you imagine waking up one morning and none of your accounts work, your website has been taken over and ransomed, your customer data sold?
That’s a worst-case scenario, but it happens every day to people just like you. Even smaller organizations and nonprofits are becoming the target of these attacks. Attacks of opportunity, when your passwords and data are leaked through a larger cyberattack, such as an attack on your web host, are some of the most common, and no one is safe from these.
Increasing your layers of cybersecurity and protection is the only way to stay ahead and mitigate the risk of an attack. Penetration testing is a great way to identify your weaknesses and fix them before a bad actor has the chance to leverage them.
Types of Penetration Testing
Let’s discuss a few of the different types of penetration testing that your organization can utilize. Generally, there are three main types of penetration testing, black box, grey box, and white box.
Black Box Penetration Testing
In a black box pen test, no information is given to the person or group performing the test. They go in on their own and attempt to penetrate defenses without prior information from you. This type of test is one of the most popular as it can be seen as truly authentic, seeing what defenses can be breached when an unknown attacker makes their first attempts. It can, however, be more costly as it is usually more extensive.
White Box Penetration Testing
White box penetration testing is opposite to black box, the tester is given full access to your system, network, and credentials and then identifies weak points as an outside 3rd party. This type of test is typically more affordable, as it takes less time and effort on the tester’s end. However, given that so much information is shared it can be seen as a less accurate method to black box penetration testing.
Grey Box Penetration Testing
As you may have guessed by now, a grey box penetration test is a mixture of white and black box. A tester goes in with a limited amount of information usually in the form of login credentials. This is a good balance between the two other penetration testings, and some believe it to be more realistic, as many times, a bad actor will do some reconnaissance and scope out an organization before attempting an attack, making a grey box test potentially the most realistic.
Subcategories of Penetration Testing
Each of the different types of penetration testing can be further broken apart into sub-categories of infrastructure, such as:
- Web Application
- Wireless
- Social Engineering
- Network
- Client Side
When choosing what kind of penetration test is best for your organization, you can choose to do some subset of these either through white, grey, or black box penetration testing, or if deemed necessary, you could choose to do them all.
Typical Penetration Test Cost
The typical penetration test costs are dependent on many factors, making the most reasonable answer to this question, it depends… On average for a small nonprofit organization, the cost of a penetration test could be in the realm of $4,000. For extremely large organizations, the spectrum swings all the way up to $100,000. Likely, if you’re reading this you are part of a small to medium-sized company, where a penetration test would cost on average $4000 – $10,000.
If you’re concerned about the cost there are other ways to increase your cybersecurity defenses outside of a penetration test. Take our free Cybersecurity Self-Assessment to get tips and recommendations on what your organization can do to increase its security.
If you do think a penetration test would be useful, you can contact us to get a more personalized quote for penetration testing services and a free cybersecurity assessment.
Or if you’d just like to stay up to date with the latest in cybersecurity tips, you can sign up for our Cybersecurity Tip of the Week.