What is penetration testing? And why you should be doing it more often

Myths, facts, and penetration testing best practices

In the vastness of the digital world, there are risks and vulnerabilities lurking behind every firewall. Now that the internet and digital tools are an undeniable part of how we live and work, media reports about cyberattacks, data breaches, and their dire consequences are a common occurrence. Research shows the average cost associated with a breach is $4.88 million, and takes an average of 258 days to identify and contain.¹

A phishing attack or data breach can have devastating effects on a company’s finances, operations, and brand reputation. Organizations and businesses know this, and they implement cybersecurity protocols to combat the threat of attacks. These practices are constantly changing, based on (and in response to) the evolving methods used by cybercriminals.

This article will tackle these questions:

• What is penetration testing, and why is it important?
• Why should companies conduct pen tests more frequently?
• What are some penetration testing best practices?

What is penetration testing? Offensive and defensive security

Some of the most common cybersecurity protections include firewalls, anti-malware software, multi-factor authentication, and network security monitoring. Most of these would fall into a defensive posture, like putting locks on the windows and doors of a house to prevent unwanted entry. But there are other ways to shore up digital defenses, and this is where some take a more offensive approach.

Prevalent offensive security tactics include red and purple teaming, vulnerability assessments, threat hunting, and penetration testing (also known as pen testing). What is penetration testing? A penetration test, or “pen test,” is a security test that launches a mock cyberattack and uses automated and manual techniques to find vulnerabilities in a computer system.²

Unlike the defensive measures meant to guard against intruders when they come, these tactics offer a comprehensive way to find vulnerabilities and remediate them before they can be exploited. Pen testing is an especially effective way to improve incident response plans, because it identifies flaws or weaknesses in existing infrastructure and simulates how a hacker could use them to gain access.

The importance of pen testing

Having defensive cybersecurity measures in place often isn’t enough to keep organizations safe. Pen testing strengthens cyber resilience and improves security posturing because of the unparalleled insight it brings. Mimicking real-world attack scenarios gives organizations valuable awareness about where their weaknesses are, and informs how they can reinforce those areas to be better protected.

In spite of widespread agreement that pen testing is foundational to cybersecurity, a confidence gap looms between the expectation that pen testing is vital and the persistence of security vulnerabilities that remain unresolved.³ The determination for why this gap exists could be explained by the prevalence of many myths and misconceptions about pen testing.

The top five myths and facts about pen testing are detailed below.

Myths and facts about pen testing

1. Pen testing is just about networks: Myth. While primarily focused on IT networks, penetration testing may include other attack vectors. Pen testing can also include physical security, phishing, or social engineering attacks.
2. Pen testing can illuminate technical and non-technical vulnerabilities: Fact. Traditional pen testing concentrates on both. Pen testing can reveal system, network, and application vulnerabilities, like system misconfigurations, weak passwords, or flawed code, but it can also identify vulnerabilities in physical assets, like cameras and sensors.⁴
3. Smaller organizations don’t need to pen test: Myth. Any business or organization with a digital footprint should be conducting pen tests. Large corporations and small businesses both collect personally identifiable information (PII) and financial data, and that mere fact leaves them vulnerable. The hard reality is no one is exempt from being targeted by ransomware or phishing attacks, and it’s important to have robust security measures in place as part of a larger risk management strategy. It also may be a requirement for cybersecurity insurance or other compliance audits (such as Payment Card Industry or PCI).
4. Organizations should conduct pen tests on an annual basis or more frequently, depending on changes to the digital environment: Fact. Some compliance audits (such as PCI) may require pen testing twice a year, but increasing the frequency of penetration testing can significantly improve an organization’s risk management and cybersecurity posture. Incorporating AI into a cybersecurity strategy (and automating some of these tests) can help companies guard their digital infrastructure, without racking up the high costs associated with manual testing services.
5. To avoid additional risk, only internal staff and employees should conduct pen tests: Myth. Pen tests can be performed by contingent workers, temporary staff, a digital services provider, or members of an internal team. The reality is not all companies have the internal expertise to conduct these tests themselves. With worker shortages rampant in tech and cybersecurity jobs, trusting an outside vendor might be the best choice. Working with a third-party also provides greater objectivity in the results. These external perspectives and specialized skillsets can benefit an organization and support a stronger cyber resiliency.

Penetration testing best practices

To help organizations get the most out of their offensive security efforts, here are some industry best practices to consider before conducting penetration tests:

• Identify clear testing goals – Not all pen tests are the same. Some are more automated, while others lean on the human aspect to provide manual techniques. Knowing the end goal(s) from your penetration test findings is critical, because it will influence how the test is conducted. If improving risk mitigation is a key objective, the pen testing approach might be different than if compliance is the main motivation. Depending on your goals, you may want to consider expanding the pen test into a purple team exercise.
• Consider a purple team exercise – A purple team exercise is a collaborative effort between the pen testers (red team) and the organization’s security (blue team). This allows the blue team to learn from the experience and improve their methods of protecting the organization in the event of a cyberattack. Purple team exercises are known to yield greater benefits, like fostering a culture of continuous learning and improving overall security posture.
• Determine your scope – Pen tests don’t broadly scour every system or application for vulnerabilities. First, you must determine the apps and systems being tested. If your organization does regular security audits, there will be an active catalog of every system, network and application critical to the organization. You’ll need to know who is responsible for securing and maintaining these assets, too. Knowing data classification and which assets are the most critical will influence what parts of your network require greater security.
• Look for common themes or root causes – A good penetration test will not only show vulnerabilities, but also group them to determine common themes or root causes. For example, multiple findings of missing patches, misconfigured technology, or weak access controls may identify a more pervasive issue than just the vulnerability. Addressing root causes can help reduce the number of findings within a pen test, and create a stronger cyber resiliency.
• Outsource offensive security to a trusted partner – An absence of tech talent and skills shortages is detrimental to cybersecurity teams. For many companies, trying to build and train an in-house team for offensive security practices is not realistic. Working with an external partner provides access to specialized knowledge, the latest tools, and objective insights, offering a more cost-effective way to protect organizations from cyber threats.

CAI is a trusted cybersecurity services provider

CAI has a long history of providing comprehensive cybersecurity services to the public sector. Our holistic approach and dedicated teams help to ensure organizations are equipped to face current and emerging threats. With managed services like pen testing, purple teaming, and tabletop exercises, we provide our clients with tailored insights that translate to improved cyber resilience.

To learn more about how CAI can help public agencies improve their cyber posture, fill out the form below.