Just as doctors must probe their patients to uncover hidden maladies or diseases, so too must companies probe their networks, systems, applications, and web assets to uncover weaknesses subject to possible hacking. The practice is called Penetration Testing, or pen testing for short. As with all issues relating to security, there are optimal ways of conduct pen tests and less than ideal ways.

This article addresses:

• The scope of cybercrime and other issues requiring rigorous pen testing
• Types of pen tests
• Expectations and responsibilities of pen testers
• Generally accepted best practices for pen testing
• Top tools to assist with pen testing
• Considerations for performing pen testing by internal staff or an outsourced firm