Penetration testing is the process of attempting to gain access to…

The idea

Penetration testing is an authorised attempt to break into a system in order to find weaknesses before a real attacker does. The defining feature in the statement is the starting position: the tester tries to reach resources without being given usernames, passwords or other normal means of access. So the tester behaves like an outsider who must discover or bypass credentials rather than log in legitimately. For example, a tester might try to reach a protected area of a school network without being handed a staff login, then report how far they got. The purpose is to reveal and fix vulnerabilities, and it is carried out with the owner's permission. Contrast this with normal use, where a user is issued credentials and logs in legitimately.

What earns the marks

• Penetration testing is an attempt to gain access to resources, i.e. to break into a system.
• The attempt is made without knowledge of usernames, passwords and other normal means of access.
• The tester therefore does not start with valid credentials and must find or bypass them.
• The aim is to identify weaknesses so they can be fixed, and it is done with authorisation.

Common mistakes and how to put them right

• Thinking penetration testing means logging in normally with a valid username and password.

  Put it right: The tester works without those normal means of access.

• Confusing penetration testing with writing malware to damage a system.

  Put it right: It is an authorised attempt to find weaknesses so they can be fixed.

Exam tips

• Anchor your answer on the phrase 'without knowledge of usernames, passwords and other normal means of access'.
• Distinguish penetration testing from ordinary legitimate login by a user who has credentials.
• Link the process to its purpose: finding vulnerabilities so they can be addressed.