Let's turn our attention to penetration testing. When we think about penetration testing, we first have to discuss the three different modes. In other words, how can we go through and actually engage in a pen test or a penetration test. And we often talk about white box, gray box and/or black box testing. We also refer to white box hacking, gray box hacking, and/or black box hacking. And you may sometimes hear those used interchangeably when we think about pen testing. But the reality is, when we think about doing a penetration test, we're thinking about the different approaches that, as a penetration tester, we're going to use. So let's just quickly figure out what those look like. When we think about a white box penetration test, what we're thinking about, ultimately, is having full knowledge, full access, full visibility, into what goes on in the network. We're going to work with our customer, whoever the person or the target is that we've been asked to work with, and we're going to get information from them. It's going to help us to be better focused and ultimately more successful at achieving the pen test. They may be able to give us access to IP address ranges, machine names, user names and passwords. They'll give us access internally on the network to allow us to plug in and to be able to effectively attack the network and probe it from inside as opposed to working on it from outside. And we'll be given the full cooperation and the full understanding of the network and the network administrators to really allow us to go anywhere we need to go. And more or less to do anything we need to do to validate the architecture and figure out where the vulnerabilities are. When we think about a gray box, we're thinking about an approach that's not quite as translucent. We're not going to see as much, not know as much, not have as much access. We may be on the inside, but we may not be given as much user information, as much IP information, as much service information. And we're going to have to figure some of that out for ourselves. We may or may not be able to rely on the help of the network administrators, we may or may not have full visibility into the network. So it's going to be a little bit more difficult, there's going to be less we're going to know, less we're going to see. And as we move towards the black box area, in a black box penetration test, we're given nothing probably other than a hand shake and an agreement that we'll be allowed to conduct the test. We're probably told what the general target is. In other words, hey, there's this company, ABC Corp. This is basically what we want you to try to accomplish, report back in two weeks, let us know what you're going to find. And then we, as the pen testers on our own are really left up to our own devices. We have to go out and do the research and do the reconnaissance to figure out how to potentially approach the network. We're not going to be given inside access, we're not going to be given much. We may be told the general IP range for the external connectivity gateways. But other than that, we're really not going to be given any usernames, any passwords. We're not going to be told the kind of services that are running, we're going to have to figure it out. Much like a hacker would have to do from outside that has no prior knowledge or inside knowledge of what the network may look like. Totally dark, no ability to see in, don't really know what's going on inside the box and we make our own way. The network team, the security team's not going to know we're coming, they're not going to help us. They're not going to be alerted to our presence, and as a result of that, they're really not going to be of any use to us. As a matter of fact, they may even be on alert being told that somebody may try to get in, may try to probe. And they may be extra vigilant so we have to take that much more care in order to figure out how to gain access without setting off alarms, or ultimately being found. And so the goal of any kind of penetration test is twofold. One, we want to be able to map out and identify areas that are strong, that are well protected. That are in effect, being protected with the proper configurations and the proper monitoring and the proper approaches that will hopefully withstand attacks from the outside. And we want to validate that architecture and know that those things are secure, and in effect are being managed well. The other part of that, the other side of the coin, is going to be for us to figure out the areas of weakness, we're going to look for vulnerabilities. We may be targeting specific vulnerabilities, we may trip across vulnerabilities without realizing that those are the ones we were looking for. The goal of the penetration test, in other words, is to figure out the extent of the good, the bad, and the ugly that may be going on inside the system. And by probing and mapping all that, we can generate a relatively complete picture depending on the level of success we achieve and the depth in which we can get into the network. More access we have, the closer we are in terms of being inside and having the understanding of the network, more likely it is we'll figure out more and find more things. So white box tests tend to give us more information because we can expose more of the network, and therefore, we can see more. But reality is, a black box test is really going to give us a much more accurate picture of what the outsider, the hacker that's going to operate without total knowledge, indeed, probably without any knowledge inside the network, is most likely to be able to accomplish or achieve. If as a black box test, we can get all the way through the network perimeter defenses, gain access to some of the secure systems, find certain vulnerabilities, potentially exploit them, it's very likely that a hacker from the outside can do the same. Whereas with a white box, because we're given all that information, while it still may be likely that a hacker could do that from outside, it's not as likely that we're going to be able to definitively say yes, they could have because we didn't have to work that hard to figure it out. White box tester typically used to map out the overall extent of vulnerabilities within the network, truly trying to expose everything we can because we know where everything is. The black box test is usually used as a definitive understanding and definitive guide to what the hacker that's operating on their own from outside with little to no knowledge of the system other than what they glean from social engineering and from external resources, can get up to or can achieve. And by combining these two visions of the network together, we usually are able to create a fairly successful picture. And usually have a relatively good understanding of the vulnerabilities, the hotspots that are going to exist on our network. So that we have to go ahead and obviously monitor, potentially, ultimately remediate in some way to fix those vulnerabilities and address them. So that way, we're not going to be liable for those risks and over time, we create a stronger defense. This is the ultimate goal, the mindset of the penetration test.