Information Security Handbook

Penetration testing

The penetration test is an authorized attack against an information system which is used to simulate a real attack that could be perpetrated by a black hat hacker.

Penetration testing is a very important part of the information security program and is needed in order to find hidden vulnerabilities in the information system. Many organizations implement vulnerability assessment tools but do not add penetration testing to their overall testing methodology. Penetration testing is important because it allows the information security program to uncover vulnerabilities that are not easily captured through automated means. The penetration tester takes their information security knowledge and uses it to systematically break into ...