Is there (some form of) penetration testing in aviation? I just listened to the first Miles to go podcast about a near miss at SFO where an Air Canada flight nearly landed on a taxiway where 4 aircrafts were waiting to take off. The incoming Air Canada flight wrongly aligned to land on the taxiway, apparently because it got confused by the lighting. Thankfully, someone noticed something was off at the last second, and the plane went around without damage.

The way I understand the podcast, it was a series of edge cases that lined up to lead to the situation. In short (please edit for accuracy if needed):
- one of the runways had its lighting off
- the aircraft had slightly old navigation equipment
- the air traffic controller was alone, and on the phone
- ...

Post incident, the inflight recorder wasn't turned off, so the critical part of the conversation was apparently recorded over, etc...

This all looks very similar to how computer security problems happen: if you input a specific value in this place at that specific moment, under this particular set of circumstances, you can get access to some confidential data.

The software industry has developed penetration testing as a method to find out such problems, where essentially you pay people to try to break into your systems, and possibly reward them every time they find a security problem. It seems like the situation above could have been identified by a similar method.

Does the aviation industry use similar practices? How does it work and what is it called? And if not, what prevents it?
There is lots of testing in aviation, in every step of the process from paper designs to an actual airframe. For situation based training the aviation industry turns to the tried and true method of  

Simulation

This is similar to software in many regards (and often uses computer based simulations). Simulator tech has come a long way in the past 35 years and full motion simulators are a great way to get very very close to the real thing. If you want to test out a situation where you knock out some random approach lights, throw in low visibility and some wind shear there is no reason to risk an actual aircraft, and a pilots life. Just queue it up in the sim and see how they do.   

When it comes to the physical testing of say an airframe the FAA (and other bodies) also tend to take the "...before we let it out there approach" to testing and certification. In other words before an airframe is certified for production it will undergo extensive flight testing that physically pushes the airframe and exposes it to situations it should never encounter in normal flight. Omega Tau does a great episode with an Airbus test pilot that goes deep into whats involved in this, its worth a listen. 

The biggest difference in aviation is that you have control over the end to end situation. In computer security you simply cant tell people "please be careful, if you use this encryption it may break in the following cases and we dont know how to fix it". On the contrary in aviation you have the ability to train pilots and more importantly you have the ability to make (or enforce) a no-go call. If we know an approach system only works down to certain minimums you simply don't fly if the weather is below them, unlike in computer security where the system is expected to always work and always be secure and in a lot of instances, always be up.