Security Advanced

What is Penetration Testing?

An authorized simulated cyberattack on a system to evaluate its security defenses and identify vulnerabilities.

Penetration testing (pen testing) mimics real-world attacks to find security weaknesses before malicious actors do. Phases include reconnaissance, scanning, exploitation, post-exploitation, and reporting.

Types include black box (no knowledge), white box (full access), and gray box (partial knowledge). Tools include Metasploit, Burp Suite, Nmap, and OWASP ZAP. Regular pen testing is essential for security compliance and risk management.

Learn More About This Topic

Ethical Hacking & Penetration Testing

Directly covers this topic

SOC Analyst Fundamentals

Related reading

SOC Analyst Advanced: Incident Response & Forensics

Related reading

Related Terms

Data Loss Prevention (DLP)

A strategy and set of tools that detect and prevent unauthorized transmission of sensitive data outside an organization.

CORS (Cross-Origin Resource Sharing)

A browser security mechanism that controls which web domains can access resources from another domain via HTTP requests.

A security model that requires strict identity verification for every user and device, regardless of their network location.

A social engineering attack that uses fraudulent communications to trick people into revealing sensitive information or installing malware.

Cryptographic Key Management

The practices and procedures for generating, storing, distributing, rotating, and revoking encryption keys securely.

Content Security Policy (CSP)

An HTTP security header that controls which resources a browser is allowed to load for a web page, preventing XSS and data injection.

View All Security Terms →