Additional types of tests include attacks through social engineering or IoT (Internet of Things) devices.

 

Gaining access – Once they create a detailed map of the organization’s system and gain a deep

 understanding of its vulnerabilities, the ethical testers will use various techniques to gain unauthorized access. This stage may involve a combination of social engineering, exploitation of software vulnerabilities, and password cracking.

Once the ethical attackers are inside a system, they will focus on digging deeper by collecting data like privileged information or credentials that may enable them to expand their control. This could include “privilege escalation” — or elevated rights, permissions, entitlements, or privileges beyond what is normally assigned for the user — in addition to creating “back doors” that may enable an attacker to return to the system at a later point and continue to move deeper, capturing even more layers of sensitive data. During this phase, the testers will mimic a malicious attacker by covering their tracks by disabling security controls, clearing logs, and taking other steps to hinder the efforts of security personnel to detect their presence.

Following the staged penetration, the testers should create and deliver a prioritized list of security issues they discovered, along with a step-by-step description of how to replicate the process, and detailed reports on weak and reused credentials.