Penetration testing: what it is, what it is not, and when to commission it.

A penetration test is an authorised, time boxed attempt to find and exploit weaknesses in a system, and to report on them so they can be fixed. It answers a narrow question: what could a competent attacker achieve within the scope and time agreed.

What it is not

It is not a compliance certificate.
It is not a guarantee of security after the test date.
It is not the same as a vulnerability scan, which is automated and unfocused.
It is not a substitute for logging, patching and staff training.

When to commission one

Before a significant release, after a merger or acquisition, in response to a regulatory expectation, or after a suspected incident to confirm remediation. In each case the value depends on a tight scope, an experienced tester, and a client who is prepared to act on the findings.

References

[01]NPCC / ACPO Good Practice Guide for Digital Evidence — Four principles governing seizure, preservation and examination of digital evidence in England and Wales.
[02]ISO/IEC 17025:2017 — Testing and calibration laboratories — International competence standard applied to UK digital forensic laboratories.
[03]ISO/IEC 27037 — Identification, collection and preservation of digital evidence — Complementary standard covering first-response acquisition of digital exhibits.
[04]Civil Procedure Rules Part 35 — Experts and Assessors — Duties and form of expert evidence in civil proceedings.
[05]Criminal Procedure Rules Part 19 — Expert evidence — Corresponding duties and content requirements for expert reports in criminal cases.
[06]Information Commissioner's Office — data protection register (ZB395023) — Computer Forensics Lab Ltd's ICO registration under UK GDPR.

Secure inquiry →Call 0207 164 69 15

← Why cyber forensics has become critical for UK legal and corporate work.All posts →Incident response: what it means in practice. →