What is pentesting? Should you handle it as an IT professional?

Penetration Testing or Pentesting can help service providers point out vulnerabilities present in the system before a malicious actor becomes aware of them. As an MSP or IT professional, you will often come across clients asking you to perform penetration testing for them.

To answer whether you should handle Pentesting or not, we need to go through what penetration testing is.

What is Pentesting?

Penetration testing, commonly referred to as “pentesting,” is a security exercise where an authorized agent tries to penetrate a system by finding and exploiting vulnerabilities present in the system.

The purpose of this simulated attack on an organization’s systems is to point out the vulnerabilities that can be exploited to gain unauthorized access. This way, vulnerabilities are identified and removed from the system before any malicious actor exploits them to gain access, steal data, etc.

Penetration Testing is carried out by ethical hackers who are certified and qualified enough to understand the complex security systems of an organization and then try to infiltrate them. These ethical hackers can work in-house or are often paid freelancers who take on this task.

Pentesting phases

Pentesting is not just infiltrating a system. A lot of work goes into pentesting a system and the process can be divided into the following phases:

1. Planning

This step depends on the scope of the pentest. Testers and clients come together to clearly define the scope and what areas should be paid special attention to. Testers also collect information about networks, domain names, servers, etc. to better understand the system to be tested. Hackers collect as much data as possible about their potential target in this step which is then used to plan out an effective strategy.

It is imperative to define the scope of the test otherwise the result may not be helpful at all as the tester might point out vulnerabilities that you were already aware of instead of looking for new ones.

2. Scanning

In this phase, testers will scan the system for any vulnerabilities they can exploit. This can be done by inspecting the application code in static/dynamic form and observing how it responds to various intrusion attempts and then devising a strategy accordingly.

Testers will also scan the network for any open ports that can be used to gain entry to the system. This can be done by using tools that will identify all the open ports available on a network. Testers need to find out as many open ports as possible to test all the entry points in a system.

3. Penetration

After gathering all the required information about their target, hackers will now try and gain access to the system by exploiting vulnerabilities that were identified in the second phase. The type of attacks used by the tester will depend on the type of system they are testing.

After gaining access testers will then try to take advantage of these vulnerabilities to either steal data, intercept network traffic, or change user privileges to realize the amount of damage that can be done by exploiting the said vulnerability.

This step will point out the security weaknesses in the system as well as how deep a malicious actor can go into the network if they are to gain access by exploiting a specific vulnerability.

4. Reporting

After the penetration phase, the tester will compile a report based on the result of their penetration testing. This report typically contains information about:

• Vulnerabilities that the hacker was able to exploit to gain access.
• Sensitive data that the hacker was able to access by exploiting said vulnerabilities.
• The amount of time the hacker remained in the system undetected.

5. Clean up and Retest

In this phase, the tester goes back into the system and removes any traces of their access so that any malicious actor who tries to gain access to the system in the future is not able to leverage these artifacts to gain access.

Retesting should also be done to make sure that the identified vulnerabilities have been removed from the system. But it is not up to the pentester to do this.

Now that we have discussed pentesting in detail and are more than familiar with what goes on in a typical Penetration Test. We can move ahead and try to answer whether an MSP should handle pentesting or not.

Pentesting as an IT professional

In short, MSPs that handle pentesting are more likely to be better at handling client security than the ones that are not pentesting providers because at the end of the day it is your job to secure your clients’ systems and networks.

IT professionals that handle pentesting will be more aware of the vulnerabilities present in their clients’ systems and thus will be more efficient at removing these vulnerabilities compared to MSPs that do not provide this service. Because in the end if your clients are safe with you, they are going to stay with you.

This eventually leads to client trust which is the biggest game changer for MSPs. If your service is trusted in the community your business will boom as your clients will not need to hire a pentesting service too. They can just ask you to perform this service for them.

Another benefit that MSPs that handle pentesting have is that after monitoring their client’s systems and networks they can carve out functional business continuity plans as they will know what kind of services their clients are going to need to stay safe. You can also onboard new clients by scanning their systems for free and offering your services to remove the vulnerabilities present.

You will also be able to secure your own systems and networks if you have in-house ethical hackers testing vulnerabilities present in your system. You can read a detailed guide about protection against cyber threats as an MSP here.

Questions to ask before handling pentesting as an MSP

Before you start offering Pentesting as a service make sure that your MSP completes all the prerequisites.

Any MSP can benefit by providing pentesting as a service but only if they are capable of handling this delicate task. Before you decide on providing this service to your clients, ask yourself this: Do I have the proper infrastructure required for pentesting available? Also, ask yourself do you have access to trusted and qualified white hat hackers?

You will also need to sit down with lawyers to work out all the legalities to make sure you do not violate any laws.

If you are planning on starting your MPS business, this is the best time to figure out if you’ll be providing pentesting as a service or not.