Last Updated on 8 June 2023 by admin
At Informer, we work collaboratively on every test – something we deem key to effective penetration testing. Unfortunately, many individuals view pen testing negatively or solely rely on pen testing tools and automated testing tools to take charge of their cyber security.
However, a cynical approach to this form of security monitoring can lead to clients not getting the best results as they can subvert the process, switch off, or isolate critical servers, or even completely remove them from the scope, thus, making their security weaknesses and vulnerabilities easy to exploit by seasoned hackers.
This mindset can prove detrimental as an attacker would look to exploit any vulnerability they discover. The underlying issue appears to stem from a perceived lack of trust by IT and security teams. They fear they could be shown up by a damning report.
In reality, penetration testers and security professionals have the same shared goal: to provide assurance that you don’t fall victim to an attack. So, how can we all work together to get the best results?
Work with and not against the tester for effective penetration testing
First and foremost, the aim of any security testing is to ensure your attack surface is as secure as reasonably possible. Independent security testing provides a fresh perspective on your web applications and infrastructure environments. They’re undertaken by skilled professionals who discover vulnerabilities every day that can often be overlooked.
At Informer, we always request a technical contact for every engagement. This means we can work collaboratively to find every vulnerability and ensure the report doesn’t show the team in a bad light. Our methods vary based on the needs and requirements of our clients.
This dynamic and collaborative approach allows for fixes to be implemented quickly and efficiently.
Web environments are increasingly complex
Networks and web applications are highly complex environments that require months of work and resources to configure securely. While it seems that pen testers only need to find one flaw to compromise an asset, a security team has to patch and securely configure hundreds to thousands of different potential entry points.
This is the very reason why security testing is imperative. With such an expansive environment, it’s all too easy for vulnerabilities to be unknowingly introduced. To get a true understanding of an application’s security risk, having a single penetration every year is possibly not the best approach.
A penetration test should not be seen as a tick-box exercise. It should be utilized as best as possible to ensure the application is hardened and reviewed whenever a code change is made.
Penetration testing in an agile world
The current model of penetration testing does not account for agile development and ongoing deployment processes. These modern development methodologies could introduce new bugs which will not be found until up to 12 months later when the next yearly penetration test takes place. Or even worse when an attacker picks it up.
If something critical is amiss, such as a missing Windows patch, often it is easier for the client to patch this system while were performing the engagement. It can then be reduced to an informational finding. This in itself demonstrates that by working closely with your testing partner, you are empowered to make changes quickly, reducing risk and affecting how this information is reported.
We are increasingly seeing penetration testing programs adapting to agile with tests being requested based on major releases and product updates. This approach is more aligned and robust than traditional annual testing, and when combined with on-the-fly fixes, it provides further assurance on reducing risk exposure.
Continuous penetration testing is now starting to gain mainstream adoption by development teams as a way to ensure that each stage of the SDLC includes manual penetration testing. This incremented approach to security testing helps a shift left security program giving CTOs assurance that each release has been penetration tested before being pushed to production environments.
Remember why you are testing
Stepping back from the testing itself, it’s worth reflecting on why you are testing in the first place. Cyber attacks are increasing in frequency and sophistication all the time, often making headline news.
In most instances, penetration tests should not be viewed as us vs them. We’re here to ensure that every known issue is discovered and every potential entry point is examined closely.
By having a robust security testing program in place, and working collaboratively with your security partner, you will get the most benefits from the project. Giving the further benefit of keeping your CEO out of the front pages.
