Penetration Testing - Limitations
Because of the swift pace of developments in the field of information and technology, the success story of penetration testing is comparatively short-lived. As more protection to the systems is required, more often than you need to perform penetration testing in order to diminish the possibility of a successful attack to the level that is appreciated by the company.
Following are the major limitations of Penetration Testing −
Limitation of Time − As all of us know, penetration testing is not at all time bound exercise; nevertheless, experts of penetration testing have allotted a fixed amount of time for each test. On the other hand, attackers have no time constrains, they plan it in a week, month, or even years.
Limitation of Scope − Many of the organizations do not test everything, because of their own limitations, including resource constraints, security constraints, budget constraints, etc. Likewise, a tester has limited scope and he has to leave many parts of the systems that might be much more vulnerable and can be a perfect niche for the attacker.
Limitation on Access − More often testers have restricted access to the target environment. For example, if a company has carried out the penetration test against its DMZ systems from all across its internet networks, but what if the attackers attack through the normal internet gateway.
Limitation of Methods − There are chances that the target system can crash during a penetration test, so some of the particular attack methods would likely be turned off the table for a professional penetration tester. For example, producing a denial of service flood to divert a system or network administrator from another attack method, usually an ideal tactic for a really bad guy, but it is likely to fall outside of the rules of engagement for most of the professional penetration testers.
Limitation of Skill-sets of a Penetration Tester − Usually, professional penetration testers are limited as they have limited skills irrespective of their expertise and past experience. Most of them are focused on a particular technology and having rare knowledge of other fields.
Limitation of Known Exploits − Many of the testers are aware with only those exploits, which are public. In fact, their imaginative power is not as developed as attackers. Attackers normally think much beyond a tester’s thinking and discover the flaw to attack.
Limitation to Experiment − Most of the testers are time bound and follow the instructions already given to them by their organization or seniors. They do not try something new. They do not think beyond the given instructions. On the other hand, attackers are free to think, to experiment, and to create some new path to attack.
Moreover, penetration testing can neither replace the routine IT security tests, nor it can substitute a general security policy, but rather, penetration testing supplements the established review procedures and discovers new threats.
