Cyber SecurityIs it Possible to Automate Penetration Testing?
By: Herm Cardona
WARNING
- Blog articles related to hacking are only for informational and educational purposes. Any time the word “hacking” is used on this site, it shall be regarded as Ethical Hacking. You may try out these hacks on your own computer at your own risk. Performing hack attempts (without permission) on computers that you do not own is a serious crime under federal law.
- Refer to the laws in your province/country before accessing, using, or in any other way utilizing these materials. These materials are foreducational and research purposes only.
- Any actions and or activities relating to the material contained within this website is solely your responsibility. The misuse of the information in this website can result in criminal charges brought against the persons in question. The author and Winmill Software will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this website to break the law.
There is no such thing as automated penetration testing. The key defining feature of a pen test is the presence of a highly skilled human pen tester. An automated penetration test, as commonly understood, is nothing more than a vulnerability assessment.
Although a penetration test is sometimes called a vulnerability assessment, many security vulnerability assessments use only automated scanners and do not simulate a skillful, determined human attacker. A significant amount of wasted opportunity occurs when penetration testing is improperly understood as a tool-based vulnerability assessment.
A true penetration test should leverage the findings from vulnerability scanning tools as a starting point for the engagement. This automated pen testing phase enables manual testers to verify critical targets as vulnerable, prioritize them, and consider exploiting them in an attempt to gain privileged access to the network.
Automation is also critical for handling mundane or repetitive processes, giving pen testers more time to pursue the more explorative and analytic processes. When used correctly, automation becomes a force multiplier, allowing a single penetration tester to cover more ground in the allocated time period. This is critical because one key difference between a penetration test and a real attack is the time available to the attacker.
No automated technology solution can test business logic. The process requires a skilled human to fully explore the possibilities. A recent study by a well-known penetration test services provider shows that only 37 percent of critical network vulnerability discoveries were found through automated scans, while 63 percent were found through manual pen testing.
There is no such thing as an automated penetration test. But there is certainly a role for automation in penetration testing. Penetration tests are time-bound engagements. Manual testing is the most productive activity, and the only way to find business logic flaws. The goal of automation is to make more time available for manual testing. To this end, domain footprint analysis, vulnerability scanning, and most of the report generation should be automated as much as possible.
Are your penetration tests making the best use of the time available? Contact us for a free consultation today!
