Penetration testing discovers vulnerabilities and determines the strength of a network before cyber-criminals do. Here's how to do it right.