A penetration test (also known as a pen test) is a simulated cyber attack against your computer system to check for exploitable vulnerabilities. In the context of web application security, penetration testing is commonly used to augment a web application firewall (WAF)

Penetration testing consists of the following stages:

1. Planning and reconnaissance
On this stage we gather intelligence (e.g., network and domain names, mail server) to understand how a target works and its potential vulnerabilities. Also we define the scope and goals of a test and the testing methods to be used

2. Scanning
The next step is to understand how the target application will respond to various intrusion attempts

3. Gaining Access
This is when we perform cyber attacks, such as cross-site scripting, SQL injection and backdoors, to uncover a target's vulnerabilities

4. Maintaining access
The goal of this stage is to see if the vulnerability can be used to achieve a persistent presence in the exploited system— long enough for a bad actor to gain in-depth access

5. Reporting results
At last, our security personnel analyze this information and we put our findings into a report that helps security professionals improve the security defenses in the application to protect from future attacks

There are various types of computer forensic examinations. Each deals with a specific aspect of information technology. The main types include the following:

Database forensics. The examination of information contained in databases, both data and related metadata;

Email forensics. The recovery and analysis of emails and other information contained in email platforms, such as schedules and contacts;

Malware forensics. Sifting through code to identify possible malicious programs and analyzing their payload. Such programs may include Trojan horses, ransomware or various viruses;

Memory forensics. Collecting information stored in a computer's random access memory (RAM) and cache;

Mobile forensics. The examination of mobile devices to retrieve and analyze the information they contain, including contacts, incoming and outgoing text messages, pictures and video files;

Network forensics. Looking for evidence by monitoring network traffic, using tools such as a firewall or intrusion detection system

The best time to conduct a pen test is right before your system is put into production and once it is no longer in a state of constant change. If a pen test is undertaken too early, your systems or networks can still have changes constantly occurring and as a result, possible security holes might be overlooked

The frequency of penetration testing largely depends on the size of your environment, how often you make changes to it, and whether you're subject to compliance standards. We recommend performing penetration testing at least once a year

However, compliance, installation of new networking infrastructure, changes in cyber policies and tolerance to cyber risk all play a role in how often penetration tests need to be performed