Are You a Fit for Penetration Testing?

Looking for the holes in someone else’s work may seem like a rather negative job. One suited for an individual who likes to say “I told you so.” Or “Look what you missed.” But this is far from the case with an IT team’s penetration tester.  

Pen testers are helpers. They love being part of the team and beyond finding things that are wrong or need repair, they want to help with finding ways to improve the flaws and make them right.  

 

In addition to this team spirit, there are a number of other skills suited to being a penetration tester. Before we dive into that aspect of the job, let’s consider where they fit into today’s cybersecurity environment. 

 

Red Plus Blue Makes Purple 

In cybersecurity, there’s a concept about team colours: red teams, blue teams and purple teams. While some will give hard and fast rules about what kinds of teams are red, blue or purple, they can actually be more fluid than expected, especially when it comes to purple teams.  

 

Red teams are those who attack. These individuals have probably taken cybersecurity courses, but they are also likely to be highly exposed to the most current and advanced tools and techniques to hack networks and systems. They may have taken penetration testing courses like CompTIA PenTest+. When working for an organization to find flaws, we call these people ethical hackers or white hat hackers.  

 

They are the ultimate penetration tester, but they work alone or with other red team members. Just as a hacker would when trying to find ways to infiltrate an organization’s system. 

 

Blue teams are the defenders. These are the IT team members who work to prevent and patch infiltrations and risks to an organization’s systems and networks. They too will also have taken some cybersecurity training and probably have even earned specific designations like a CompTIA security+ certification among other credentials. The goal here is to combat anything the red team (and ultimately the real hackers or black hat hackers) might exploit. 

 

Purple teams are defined as the team that oversees and optimizes the red and blue teams working together. It’s a bit like a double-agent role where they constantly work with the two teams to feed them more information to find ways to weaken the other’s attempts. Penetration testing courses can be a huge benefit to those in this traditional purple role so that they can suggest areas to thwart the work of the red or blue teams. 

 

PenTest Goes Purple 

However, we propose a different look at the purple team and suggest that some penetration testers can really morph into the ultimate purple team rather than being on the red team. Any penetration testing done by the red team is typically done on their own, without knowledge of the blue team unless they are fed information.  

 

Instead, in a different format for the purple team, we know there are pen testers who work within the organization’s space are connected to the blue team. They attend meetings together, interact and share information which makes them far less red and much more purple. They do “red team” work to find flaws and expose issues, but not with an “I told you so” attitude. They look at these weaknesses as opportunities to work with their team members to help guide ways to fix issues and improve the organization’s effectiveness as a whole.  

 

Who Makes a Good Penetration Tester? 

Definitely someone who is interested or involved with IT and specifically cybersecurity, is a good candidate for pen testing, but there’s more to it than that. Penetration testers are inherently curious. They are meticulous and enjoy going “down a rabbit hole” looking for detail. Not only are they good at documenting everything they do, but they are also good communicators, able to tell others exactly what they did and how something happened.  

 

To excel as a penetration tester, you need to enjoy working with others to not only find problems but also suggest solutions. You should be equally comfortable working on your own as well as in a team environment and you enjoy reviewing data and creating reporting methods. 

 

Additionally, you need to have strong communication skills to assess how organizational team members may be creating security problems. If you find potential password or security issues in an individual’s behaviours, you’ll need to have the person-to-person interaction skills to help them understand the problem and the solution.   

 

Pick Your Team 

Whether you decide to take your penetration testing skills to the red team or work in a new purple team role, you’ll be doing work that makes a difference. There is no stopping the volume of cybersecurity attacks and penetration testing is the true home of prevention. Your organization may not throw a party in your honour when you do great work, but you will be appreciated.

Written by Ronda Payne