{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/penetration-test","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/penetration-test/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/penetration-test/"},"term":{"en":"Penetration test","da":"Penetrationstest"},"aka":{"en":["pentest","pen test","ethical hacking"],"da":["pentest","etisk hacking"]},"domain":["security"],"cluster":"controls","layer":"governance","status":"current","era":1972,"summary":{"en":"An agreed, simulated attack in which skilled testers try to break in, to show how well systems really hold up.","da":"Et aftalt, simuleret hackerangreb, hvor dygtige testere forsøger at bryde ind for at vise, hvor godt systemerne reelt holder."},"body":{"formal":{"en":"An authorised test, limited in scope and time, in which people use the same methods as real attackers to find and actually use weaknesses, chaining them together to show what an attacker could reach.","da":"En godkendt test, begrænset i omfang og tid, hvor personer bruger de samme metoder som rigtige angribere til at finde og faktisk udnytte svagheder og kæde dem sammen for at vise, hvad en angriber kunne nå."},"plain":{"en":"Like hiring a professional burglar to try to break into your shop, with your permission, and then write down exactly how they got in.","da":"Som at hyre en professionel indbrudstyv til at prøve at bryde ind i din butik, med din tilladelse, og bagefter skrive præcis ned, hvordan det lykkedes."},"inPractice":{"en":"Testers hired by a Danish region find a forgotten test website, use a weak password there to get onto the network, and within two days show the IT security manager they can read the finance folder.","da":"Testere hyret af en region finder en glemt testhjemmeside, bruger en svag adgangskode der til at komme ind på netværket og viser inden for to dage IT-sikkerhedschefen, at de kan læse økonomimappen."},"whyItMatters":{"en":"Lists of weaknesses do not show how they combine; seeing a real path from outside to valuable data convinces management and shows what to fix first.","da":"Lister over svagheder viser ikke, hvordan de spiller sammen; at se en reel vej udefra til værdifulde data overbeviser ledelsen og viser, hvad der skal rettes først."}},"deepDive":{"en":"Penetration testing grew out of the \"tiger team\" exercises commissioned by the US military and government in the late 1960s and 1970s; James P. Anderson's 1972 Computer Security Technology Planning Study for the US Air Force described penetration of systems as a way to demonstrate their weaknesses. Modern practice is codified in methodologies such as NIST SP 800-115 (planning, discovery, attack and reporting phases), the Penetration Testing Execution Standard (PTES), OSSTMM and, for web applications, the OWASP Web Security Testing Guide. A typical engagement moves through reconnaissance, enumeration, vulnerability identification, exploitation, post-exploitation (privilege escalation, lateral movement, access to agreed \"flags\" such as a file share or a domain admin credential) and reporting.\n\nThe legal and contractual frame is not a formality. Testing without authorisation is unlawful access to a computer system; in Denmark that is criminal under section 263(1) of the Penal Code (straffeloven). The rules of engagement therefore fix the scope (IP ranges, hostnames, applications, cloud tenants - and explicit exclusions), the testing window, permitted techniques (is social engineering, denial of service or physical access in scope?), emergency contacts and a stop procedure, handling of any personal data encountered, and written authorisation from someone who actually owns the systems. Cloud and hosting providers have their own policies on testing their platforms, and third-party SaaS is usually out of scope unless the provider consents.\n\nEngagements are classified by the knowledge given to testers: black box (none, emulating an external attacker), grey box (credentials or documentation, often the most efficient use of testing time) and white box (full source code and architecture access). Scope types include external network, internal network (often starting from an \"assumed breach\" foothold), web and API, mobile, wireless, cloud configuration and social engineering. A red-team exercise differs in objective: it tests detection and response against a stealthy, goal-oriented adversary over weeks, whereas a pentest tries to find as many exploitable weaknesses as possible within a scope. Threat-led penetration testing (TLPT) under the TIBER-EU framework, and mandatory for certain financial entities under DORA Art. 26, is effectively intelligence-led red teaming.\n\nThe report is the product: an executive summary, attack narratives showing how findings chain together, each finding with evidence, affected assets, a severity rating (often CVSS with contextual adjustment) and remediation guidance, followed by a retest to confirm fixes. PCI DSS v4.x requirement 11.4 mandates internal and external penetration testing at least annually and after significant changes; CIS Controls v8 Control 18 places pentesting at IG2 and IG3, since it adds most value once basic hygiene is in place. A pentest is a point-in-time sample, not an assurance that no other weaknesses exist.","da":"Penetrationstest voksede ud af de \"tiger team\"-øvelser, som det amerikanske militær og den amerikanske stat bestilte i slutningen af 1960'erne og i 1970'erne; James P. Andersons Computer Security Technology Planning Study for US Air Force fra 1972 beskrev indtrængning i systemer som en måde at påvise deres svagheder på. Moderne praksis er kodificeret i metoder som NIST SP 800-115 (faserne planlægning, opdagelse, angreb og rapportering), Penetration Testing Execution Standard (PTES), OSSTMM og for webapplikationer OWASP Web Security Testing Guide. Et typisk forløb går gennem rekognoscering, enumerering, identifikation af sårbarheder, udnyttelse, post-exploitation (rettighedseskalering, lateral bevægelse, adgang til aftalte \"flag\" som et fildrev eller en domæneadministrators legitimationsoplysninger) og rapportering.\n\nDen juridiske og kontraktlige ramme er ikke en formalitet. Test uden tilladelse er uberettiget adgang til et datasystem og i Danmark strafbart efter straffelovens § 263, stk. 1. Rules of engagement fastlægger derfor omfanget (IP-intervaller, værtsnavne, applikationer, cloud-tenants - og udtrykkelige undtagelser), testvinduet, tilladte teknikker (er social engineering, denial of service eller fysisk adgang omfattet?), nødkontakter og en stopprocedure, håndtering af personoplysninger, testerne støder på, og en skriftlig tilladelse fra en, der faktisk ejer systemerne. Cloud- og hostingudbydere har deres egne politikker for test af deres platforme, og tredjeparts-SaaS er normalt uden for omfanget, medmindre udbyderen giver samtykke.\n\nOpgaver klassificeres efter den viden, testerne får: black box (ingen, efterligner en ekstern angriber), grey box (legitimationsoplysninger eller dokumentation, ofte den mest effektive brug af testtiden) og white box (fuld adgang til kildekode og arkitektur). Typer af omfang omfatter eksternt netværk, internt netværk (ofte med udgangspunkt i et \"assumed breach\"-fodfæste), web og API, mobil, trådløst, cloudkonfiguration og social engineering. En red team-øvelse har et andet formål: den tester detektion og respons over for en skjult, målrettet modstander over uger, mens en pentest forsøger at finde så mange udnyttelige svagheder som muligt inden for et afgrænset omfang. Trusselsbaseret penetrationstest (TLPT) efter TIBER-EU-rammen, som er obligatorisk for visse finansielle enheder efter DORA art. 26, er i praksis efterretningsdrevet red teaming.\n\nRapporten er produktet: et ledelsesresumé, angrebsfortællinger, der viser, hvordan fund kædes sammen, og for hvert fund dokumentation, berørte aktiver, en alvorsgrad (ofte CVSS justeret for kontekst) og anbefalinger til afhjælpning, efterfulgt af en retest, der bekræfter rettelserne. PCI DSS v4.x krav 11.4 kræver intern og ekstern penetrationstest mindst én gang om året og efter væsentlige ændringer; CIS Controls v8 Control 18 placerer pentest på IG2 og IG3, fordi den giver mest værdi, når den basale hygiejne er på plads. En pentest er et øjebliksbillede, ikke en garanti for, at der ikke findes andre svagheder."},"edges":[{"type":"requires","to":"security/vulnerability","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/vulnerability-scanning","why":{"en":"A scan automatically lists known weaknesses; a pentest has people actually use and combine them to prove real impact.","da":"En scanning finder og nævner automatisk kendte svagheder; en pentest lader mennesker faktisk udnytte og kombinere dem for at bevise den reelle konsekvens."},"confidence":"high","strength":"primary"},{"type":"contrasts-with","to":"security/vulnerability-assessment","why":{"en":"An assessment ranks weaknesses on paper; a pentest proves which ones can really be used by trying.","da":"En vurdering prioriterer svagheder på papiret; en pentest beviser ved at prøve, hvilke der reelt kan udnyttes."},"confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment","tier":"standard","publisher":"NIST"},{"title":"CIS Critical Security Controls v8 - Control 18","tier":"standard","publisher":"Center for Internet Security"}],"draft":true}