Risks associated with cybersecurity threats and exposures motivate organizations to implement protective controls intended to keep their digital assets safe from malicious computer hackers.
We display a similar strategy when protecting our physical assets. Our homes have locks on entry doors and windows. Security systems to detect intruders. Fences that prevent access to private property and camera surveillance to monitor for threats.
What is Penetration Testing?
Protective controls are important to have in place, but it is equally important to test the effectiveness of the controls themselves. Have you ever left your home, shut the door, and then reached back to jiggle the doorknob to make sure the door is latched and locked? This is an example of testing a protective control. The same concept applies to the digital world, we must test our cybersecurity controls to ensure they are working as intended.
One common way to test the effectiveness of cybersecurity controls is to conduct a penetration test. Penetration Testing is an exercise in which an ethical computer hacker will simulate an actual cybersecurity attack against your organization. They will execute the same actions and behaviors of a malicious hacker to identify weakness with your cybersecurity controls. We tend to assume that our firewall is keeping us safe, like the assumption we make that our locked front door is keeping our home safe. But unlike our ability to jiggle the doorknob of the door, there is no tangible way to verify that the firewall is working. This is why penetration testing is such a valuable exercise to complete.
The Benefits of Completing a Penetration Test:
1) Test the effectiveness of your cybersecurity controls that you otherwise assume are protecting you.
2) Improve your cybersecurity controls after reviewing the results of the penetration test
3) In many cases, help satisfy the burden of compliance with state or federal regulation.
How to Choose the Right Service Provider:
Penetration tests that are performed incorrectly will not properly identify the REAL concerns and exposures that exist within your technology environment. This can promote a false sense of wellbeing and security only to learn the hard way that your network was not as secure as you may have thought. Instead, a penetration test should produce a clear understanding of the improvements that can be made to better secure and protect the organization from threats like computer hackers.
Here are 10 ways to ensure that a service provider is right for you.
1) Is there a human being completing the penetration test?
Buyer beware - many low cost penetration tests are "automated" and involve little to no human effort. This is a BIG problem because real cyber attacks launched by actual computer hackers are not automated. Attackers use critical thinking, logic and reason to carry out sophisticated and organized cyber attacks - a good penetration test should simulate their approach instead of being limited by the capabilities of tools designed to "automate" the penetration test.
2) Is the person(s) conducting the penetration test qualified and experienced?
There are many IT professionals and generalist who claim to be proficient in the art of penetration testing, but have every intention of learning on your dime. Hiring someone who does not have experience and is not certified is a risky move. Look for someone who has conducted at least 75 penetration tests and holds one or more of these industry certifications (and do not be afraid to ask for proof):
- Certified Ethical Hacker (CEH)
- Offensive Security Certified Professional (OSCP)
- GIAC Penetration Tester - (GPEN)
3) Can they explain the difference between a penetration test and a vulnerability scan? Will they perform a vulnerability scan while doing the penetration test at no extra cost?
One of the biggest misconceptions is that a vulnerability scan and penetration test are the same exercise. This means that many cybersecurity firms will sell you a penetration test but will only perform a vulnerability scan. Vulnerability scans will identify Common Vulnerabilities and Exposures (CVE). Penetration testing attempts to exploit those vulnerabilities in an effort to compromise systems and controls.
It is common for hackers to scan your network and find vulnerabilities, but they don't stop there. Based on their findings, they proceed to launch specific attacks designed to exploit the discovered vulnerabilities. Be sure you are getting what you pay for. Don't purchase a penetration test only to have a vulnerability scan completed.
4) Do they insist on having a discussion about Rules Of Engagement (ROE) prior to doing the penetration test?
It is important to discuss the inherent risks associated with penetration testing and it is also important to determine how intense the testing will be. For example, is the Ethical Hacker allowed to transfer, delete or alter data once a system is compromised? Are they allowed to launch Denial of Service attacks that may cause service disruption? Can they test during normal business hours? These are just a few questions that need to be discussed and answered prior to executing a penetration test. Rules of Engagement allow for risk(s) to be mitigated and establish guidelines for testing.
5) Do they include social engineering attacks as part of their testing procedures?
Not all penetration tests include the same types of attack vectors which means that many providers will not launch social engineering attacks such as email phishing. Social engineering is a wildly popular method for hackers to circumvent traditional security controls such and firewalls. The vast majority of all successful cyberattacks involve some element of social engineering. So this attack vector should absolutely be included in any penetration test performed.
6) Do they provide flexibility with logistics and scheduling or does the penetration have to be completed during their normal business hours?
Many cybersecurity firms will demand that the penetration test be completed during their normal business hours and if you request to have the work done at night or over the weekend (if you are worried about possible disruptions to business) then the provider will seek additional compensation or refuse. It is important that you have the ability to control when the penetration test will take place.
7) Do they make their penetration tester(s) readily available during the testing process?
Some abnormal activity may be detected by your security tools or employees during a penetration test and it is imperative that you have instant access to the penetration tester to verify that they are the responsible party vs a legit attack. Many service providers make it impossible to contact the penetration tester(s) directly.
8) Does their report include information that matters and is actionable of is it a simple list of open ports and discovered vulnerabilities?
While it is good to know the results or basic discovery and reconnaissance efforts, a final report for a penetration test should include more than a list of open ports and vulnerabilities. The objective of a penetration test is for you to understand how an actual hacker would logically attempt to exploit your vulnerabilities and the sequencing of attacks they would deploy so that you can improve your security control framework. Your report should include meaningful and actionable information such as:
- A comprehensive narrative of the testing event provided by the penetration tester
- A detailed evaluation of each attack vector, including visual diagrams, evidence of success, and specific remediation recommendations.
9) Do they hold a formal meeting to present their findings or do they simply forward your report and wish you the best?
The deliverable for a penetration test is typically a formal report that explains the outcome of the penetration test in the form of findings and recommendations. It is important for the penetration tester to take the time and review the contents of this deliverable with you and other interested stakeholders so that a crystal clear understanding can be achieved and you know exactly what to do next. Interrupting the report on your own can be difficult due to the technical information contained within.
10) Do they offer customer loyalty discounts for repeat customers and allow monthly payments for penetration testing?
It is recommended that penetration testing become an operational component of an organizations' cybersecurity program. The exercise should be conducted periodically according to organizational policy and regulatory requirements. If you are going to conduct an annual penetration test, wouldn't it be nice to receive a discount for being a loyal customer? And wouldn't it be nice to pay for annual penetration testing services as an operating expense instead of a capital expense?
How Databranch Can Help:
Interested in learning more about Penetration Testing and how it will enhance your companies security? We are more than happy to discuss our penetrating testing service and the benefits it provides.
