Cybersecurity Beyond the Basics: Penetration Testing

When you want to know if what you’re doing to protect your organization from cyber-attack is effective, you should check your security controls with a penetration test (or pen test). A pen test simulates what a real attacker might do to get into your network and capture the credentials and privileges that would give them ultimate power to do anything they want in your IT systems.

Discovering if your systems can be compromised is a good thing for you to do if you’re a business leader managing risk. However, the need for a pen test may be dictated by someone or something outside your organization – like a vendor, a compliance requirement, or a cyber insurance application – which really drives home the fact that there are other stakeholders besides you who care about how you’re keeping data and access to your IT systems safe.

What’s a Pen Test?

The goal of a pen test is to take on the role of an attacker and look for weaknesses that can be used as entry ways into your IT environment. Pen tests can be done manually or through an automated process. Either way, the facilitator needs to have the technical expertise required to interpret the results and turn them into actionable recommendations.

Are Pen Tests and Vulnerability Scans the Same Thing?

While both pen tests and vulnerability scanning can be grouped under “Vulnerability Management” they are not the same thing. The goal of vulnerability scanning is to look for weaknesses that need to be remediated. The goal of pen testing is to test defenses and expose flaws that you wouldn’t otherwise know existed.

Common Pen Test Findings

The report that emerges from a pen test can reveal the maturity level of your organization’s cybersecurity strategy. For example, if you haven’t been utilizing basic cybersecurity best practices like keeping software and operating systems up to date, that will be on the report.

The ability of the pen test to go deep is where you’ll bring to light issues that cyber attackers are looking for that you never knew were issues. Here are some examples:

Firewall ports left open and use of insecure communication protocols like FTP.

Default credentials on connected equipment like printers and IoT devices.

Default Windows settings that allow access to network devices.

Weak passwords that are allowed by the organization’s password policies.

Hidden systems that have been forgotten and neglected.

Large attack surfaces are present due to lack of systems hardening.

How About Pen Testing for Your Managed IT Service Company?

Some Managed Service Providers (MSPs) are evolving “Purple Teams” to validate the controls that they have in place that safeguard their own data and systems. The concept of the purple team comes from blue and red teams. Blue teams build and maintain security. Red teams try to bust through security.

With the introduction of automated pen testing that creates a hands-off process, MSPs are able to get a more objective view of how their security layers stack up compared to testing it manually themselves.

Do You Need a Pen Test?

Instead of wondering if your organization needs a pen test, a better question to ask is — Are we effectively managing cyber risk? A pen test is just one of the tools that an MSP will use to determine where there are gaps in your security and what you need to do to close them up.

Cybersecurity Assessments for New Orleans Companies

Here at Bellwether, we help companies craft and implement cybersecurity strategies that meet up with their risk profile and tolerance, plus any compliance requirements. The best first step that you can take towards a more cyber secure future is to schedule a cybersecurity assessment.

Learn about cybersecurity assessments and get your questions answered.