Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/2/2020
05:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

A Day in The Life of a Pen Tester

Two penetration testers share their day-to-day responsibilities, challenges they encounter, and the skills they value most on the job.

All organizations have vulnerabilities, but they can't fix them until they find them. It's the job of penetration testers to put themselves in an attacker's shoes and find flaws before the bad guys do.

Penetration testing, also known as pen testing, involves testing networks, computer systems, and Web and mobile applications to discover vulnerabilities that could potentially put an organization at risk. Pen tests may simulate human- or technology-based social engineering attacks against an organization's employees to see how people could put a business at risk.

Some companies have penetration testers on their internal security team to test products and systems for vulnerabilities. Many outsource pen testing to consulting or professional services firms, which are staffed with professionals who are trained to break into systems and report back to the client which applications or systems were breached, how they were exploited, and how the organization can mitigate those issues to defend against future cyberattacks.

Security consultant Gisela Hinojosa and security analyst Carlota Bindner are pen testers at Rapid7. The two women are on separate teams under the firm's penetration testing division, and both spend their days on internal and external network penetration testing, mobile and Web application testing, Internet of Things (IoT) testing, and other engagements. "It depends on the type of assessment you're on," says Hinojosa, who has been pen testing at Rapid7 for about three years. 

What does a pen tester's day look like? Mornings are usually pretty busy, she says, as that's when the testing starts. If she's doing an internal pen test, she'll set up the tools she needs and start by collecting open source intelligence (OSINT), which she can use to launch attacks. Hinojosa spends most of the day testing, with occasional meetings throughout the day. The typical engagement lasts about five days but can be shorter or longer depending on the project. 

External pen testing is the practice of testing an organization's externally facing assets. During an external pen test, testers try to access the internal network by exploiting flaws found on external assets. They have to collect intel on open ports, vulnerabilities, and other aspects of the business to launch their attack. Once they're in, they can move on to the internal pen test. External pen tests are more introductory; internal tests involve more detail and complexity.

"That's when we find the most loot," says Hinojosa, who adds internal testing is usually more rewarding because that's when they're trying to gain domain administrative access. "But it's also a lot more work, especially with reporting, because that's when you have the most findings." The amount of required reporting also varies by project, she continues, but they try to start compiling the reports by midweek so as to not leave everything until the last minute.

Bindner, who also spends most of her days testing devices and systems, with meetings throughout, says the flow of her engagements is similar: OSINT, scanning, enumeration, and finding and exploiting vulnerabilities. Internal and client meetings mark the beginning and end of the day, so the client knows when testing has begun and receives an overview of what was found at day's end. "It's to keep them informed throughout the engagement," she explains. 

The process and tools involved depend on what the assessor is breaking into. If they're testing a Web application, for example, they're given a URL to test on. For external networks, they're given IP addresses; for mobile applications, they're given the name of the app to download or the .IPA file if the app hasn't yet been released, Hinojosa says. Mobile testing also requires a jailbroken iOS device or a rooted Android device. IoT testing demands equipment, such as soldering stations to remove chips, and oftentimes debugging hardware and software are required, Bindner adds. Rapid7 has a lab, she says; some testers have their own supplies.

"It's not just about the device sitting alone," she says of the complexities of IoT testing. "It's all the different components it interacts with."

Pen Testing Problems and Perks
One of the frustrations of pen testing is "we are provided a limited amount of time to perform the job we do," Bindner says. Pen testers have to stay within the scope of each engagement, she continues. Sometimes she'll find something she's interested in and want to keep digging deeper, but the limits of the engagement mean they have to move on to finish in time.

On the flip side, Hinojosa says, sometimes clients want to add something to the scope of a project that wasn't agreed on before, which can interfere with the engagement timeline.

Despite frustrations, both women say they enjoy pen testing because "it's like a puzzle you're trying to solve, and it's a challenge," says Hinojosa, a former quality assurance analyst who did software testing for six years before joining Rapid7. She brought her software testing skills to her new role, where she learned from colleagues and was trained on the job to become a pen tester. 

"There's something very rewarding about knowing … while our actions might be those of an attacker's, we're doing it to make sure companies are safer in the long run," says Bindner, whether those actions are getting cross-site scripting on a website or moving from an external network to an internal one. Bindner, who has a degree in animal science, went through the SANS Women's Academy and then trained in Rapid7's security consultant development program.

Both women agree research skills are paramount to succeeding as a pen tester, as there are new vulnerabilities frequently coming out and many different attack scenarios they may not be aware of, Hinojosa says. They're always researching and learning to stay in the loop. It's not just about being able to search something, they agree, but understanding what to look for.

"This field, much like in any other complex field, requires continuous learning," Bindner sayss.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Untangling Third-Party Risk (and Fourth, and Fifth...)."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13890
PUBLISHED: 2020-06-06
The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard.
CVE-2020-13889
PUBLISHED: 2020-06-06
showAlert() in the administration panel in Bludit 3.12.0 allows XSS.
CVE-2020-13881
PUBLISHED: 2020-06-06
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.
CVE-2020-13883
PUBLISHED: 2020-06-06
In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition or update of a Lifecycle.
CVE-2020-13871
PUBLISHED: 2020-06-06
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.