In general, hackers try to bypass or break protective mechanisms in order to gain unauthorized access to data. The field of penetration testing therefore emerged more or less as a kind of countermeasure by IT security in the arms race with attackers: potential clients ask - or commission - pentesters to identify the vulnerabilities in their IT systems so that these can ultimately be hardened or closed.
In doing so, a pentester consistently applies the same technical methods as a malicious attacker. But not only that. A structured approach is also required in order to achieve reproducible results. Without such an approach, (obvious) vulnerabilities can remain undetected. Unlike a hacker, a pentester is not satisfied with a single entry point into the IT system - they want to uncover all of them. Likewise, the identified vulnerabilities have to be communicated to the client. This is usually done in a final report or a presentation, in which the vulnerabilities must not merely be listed, but also prioritized according to their risk. Consequently, hacking is “only” the technical part of a pentest.
To date there is neither a state-recognized vocational training nor a comparable degree program in penetration testing, which is why it is common in the information security sector to acquire and/or demonstrate such specialized skills and abilities through certification programs. With regard to penetration testing, the certificates CEH from EC-Council and OSCP from Offensive Security in particular are widespread - yet they differ as day and night in how the participants are examined. While the CEH certification can be obtained via a theoretical exam - multiple-choice questions, to be precise - future OSCPers have to complete a 24-hour practical exam in which 5 IT systems are to be fully compromised. Regardless of that, I see both certifications as focused on technical understanding, which admittedly forms the foundation of a penetration test but is not enough on its own; for me a point of criticism - without wanting to call the difficulty level of either exam into question.
At least for me, the transition from the OSCP exam environment to the real world was hard. This was most noticeable when it came to the susceptibility of IT systems to security vulnerabilities. Compared to Offensive Security’s practice lab, in reality one often encounters (stricter) security measures, meaning the complete compromise of an IT system cannot always be achieved. In addition, the client commissioning a pentest usually expects every vulnerability in their IT systems to be identified, which is why the test does not end with uncovering the first open door. Reporting, too, is cast in a very different light, since it is the only document the client will end up holding in their hands. In short: the OSCP’s playground came to an end and reality set in. Unfortunately, it came as a surprise, since none of the numerous reviews I had consulted on the internet had mentioned the differences compared to the actual field of work of a penetration tester.
After acquiring the formal qualifications to run a course - with my B.Sc. in Computer Science from Hochschule Darmstadt (h_da) and the professional experience I had gathered as a pentester at binsec GmbH - I wanted to pass on my knowledge around penetration testing. People with a leaning towards IT security were to get an “easier” entry into the subject than I had at the time. With the approval of the “IT Security” department group at h_da, I designed the elective module “Penetration Testing”, in which students learn and apply the pentest primer - from classifying a pentest, through the actual hacking, to writing the report - using the example of a fictional company network. Initially this was still done with the help of Amazon AWS; but given the high demand and the positive feedback from my students, we at binsec decided to design a global online certification program: the BACPP (Binsec Academy Certified Pentest Professional) qualification, which consists of an online exam, the “Pentest Exam”, and an optional online training, the “Pentest Training”.
While the online training historically developed out of my university course, in the “Pentest Exam” IT specialists can demonstrate their expertise under newly designed, real-world conditions. Certified BACPP holders can
- compromise IT systems and develop zero-day exploits,
- examine networks and applications for vulnerabilities following a reproducible methodology,
- document all of their findings in a structured report for the client and prioritize them according to their risk,
- professionally conduct a multi-day penetration test.
In hindsight, my (time-intensive) interdisciplinary work seems to have paid off: using situated learning in information security has not only sparked the enthusiasm of many students, but has also appealed to the first BACPP certificate holders. The theory of situated learning relies on realistic application scenarios to convey knowledge, and these are the defining hallmark of my courses and my trainings. The BACPP was conceived along the same lines and is built on demonstrating practical, real-world experience.