How to Conduct a
Standard Penetration Text

Step One: Goals and Scope

This is the planning stage where you identify which systems you will be testing and what methods should be used.

• Create a list of the systems you will test.
• Define which methods you will use to attempt to gain access to those systems.
• Gather information (like domain names or mail servers) to use during the simulated attack.

In this stage, it may be beneficial to partner with a managed service provider like PCS to get an outside view of your systems and to prevent internal bias.

Step Two: Reconnaissance

In a real cyberattack, the bad actors will attempt to understand how the target systems respond to intrusions.
Here are the steps cybercriminals usually take that your team should emulate during a penetration test:.

• Inspect application code. Usually, the entire code is inspected in a single pass.
• Inspect the application code while it is running. This provides even greater detail into the performance of your systems.

In this stage, it may be beneficial to partner with a managed service provider like PCS to get an outside view of your systems and to prevent internal bias.

Step Three: Infiltrate

In this stage, bad actors use web application attacks like cross-site scripting to uncover vulnerabilities.
As your Pen Test Team copies these steps, they should then:

• Attempt to escalate privileges.
• Access and steal data.
• Intercept traffic.

Bad actors will exploit any vulnerability they find in order to understand to what extent
they can penetrate your organization’s systems.

Step Four: Persist

Once cybercriminals have gained access to your systems, they will attempt to maintain access and establish a solid presence long enough to gain access to sensitive data. Cybercriminals (and your Pen Test Team) will attempt to:

• Create advanced persistent threats (APTs).
• Sabotage critical organization infrastructure.
• Gain access to your company website and make changes.
• Steal sensitive information (like social security numbers or private user data).
• Steal intellectual property (like patents or trade secrets).

Step Five: Resolve

Your final step is to compile a report of the performance of your systems during the simulated attacks. This report will be used to strengthen your security and train your IT team. Make sure to:

• Specify vulnerabilities that were exploited.
• List sensitive data that was “lost” or stolen.
• Specify the amount of time the threat remained undetected.