A penetration test (also known as a pentest) is a security assessment that simulates the activities of real-world attackers to identify security holes in your IT systems or applications.
The aim of the test is to understand what vulnerabilities you have, how they could be exploited, and what the impact would be if an attacker was successful.
Usually performed first, an external pentest (also known as external network penetration testing) is an assessment of your perimeter systems. Your perimeter is all the systems that are directly reachable from the internet. By definition, they are exposed and are, therefore the most easily and regularly attacked.
Testing for weaknesses
External pentests look for ways to compromise these external, accessible systems and services to access sensitive information and see how an attacker could target your clients, customers or users.
In a high-quality external pentest, the security professional(s) will copy the activities of real hackers, like executing exploits to attempt to gain control of your systems. They will also test the extent of any weaknesses they find to see how far a malicious attacker could burrow into your network, and what the business impact of a successful attack would be.
Run external pentests first
External penetration testing assumes the attacker has no prior access to your systems or networks. This is different to an internal penetration test which tests the scenario where an attacker already has a foothold on a compromised machine or is physically in the building. It usually makes sense to cover off the fundamentals first and consider internal testing after both regular vulnerability scanning and external penetration testing have been done.
How to perform external penetration testing
So how do you go about getting an external penetration test?
Scheduling an external pentest should be as simple as asking your managed service provider or IT consultancy, and pointing them at your perimeter systems (a list of domains and IP addresses/ranges).
Sustained password-guessing attacks (spraying, bruteforce) to try to compromise user accounts on exposed VPNs and other services
Scraping the dark web and breach databases for known breached credentials of your employees, and stuffing them into administrative panels and services
Web application testing where a self-registration mechanism is available
Social engineering attacks such as phishing your employees
Pentests can't replace regular vulnerability testing
Remember that new critical vulnerabilities are discovered daily, and attackers usually exploit the most serious weaknesses within a week of their discovery.
Whilst an external penetration test is an important assessment to take deep look into the security of your exposed systems, it's best used as an extra service to complement regular vulnerability scanning – which you should already have in place!
