Protecting your Enterprise with Penetration Testing
By: Robert Wilkinson, Board Advisor, Obrela
In the arsenal of cyber security tools available to organizations, the penetration test is a key component. Business applications, and organization infrastructure (operating systems, databases, networks, etc.) all have potential vulnerabilities, many of which are just waiting for threat actors to exploit. In order to ensure that your organization remains safe from attack, you need to regularly scan software and hardware to ensure any vulnerabilities have been identified and remediated; this includes applications and products provided by vendors. By performing a penetration test, organizations are able to identify whether they have existing vulnerabilities that can lead to sensitive information compromise or business services disruption, resulting in financial and reputation loss. Penetration tests can also help determine whether organization employees are susceptible to social engineering or phishing attacks if this is included in the scope of the test. A penetration testing program strengthens your security posture, allowing you to stay ahead of existing and new vulnerabilities and associated threats, which are constantly evolving in an effort to exploit the vulnerabilities.
The penetration testing process starts with defining the scope of the test; for example, will it focus on a specific application, or will it focus on an organization’s infrastructure? Will it be performed in your production environment, which entails the risk of service disruption, or will it be performed in a more controlled (and safer) testing environment. Different types of penetrations tests have different requirements. Once the scope is defined, the penetration test can be executed. If the test involves a production environment, this is usually performed during non-critical business hours to avoid potential service disruption.
Following the penetration test, the testing team shares a report with your organization outlining the findings, along with recommended steps to remediate the identified vulnerabilities. The business and security teams can then decide necessary actions and future enhancements to ensure continued business security and operational resilience.
Ways in which a penetration test can protect your business:
- Staying Ahead of Hackers and Ensuring Operational Resilience
A penetration test can uncover security vulnerabilities before they can be exploited, empowering an organization with the necessary skills and expertise to identify, understand and report back on these vulnerabilities (and the recommended remediation process) to close a gap which could have been exploited by a threat actor resulting in potentially significant damage to your organization.
- Ensuring Regulatory Compliance
While penetration testing is typically used to secure networks, systems and data, it also helps businesses comply with security and privacy regulations. This is because a penetration test serves as a de facto audit, identifying potential HIPPA, GDPR and other regulatory violations. In addition, many regulatory standards have made penetration tests a requirement for certification (e.g. PCI DSS).
- Adopting a Holistic Approach to Security
Application testing covers business applications, such as web and mobile applications. The use of penetration testing frameworks such as OWASP has improved security markedly over the last decade. The problems which are identified typically relate to application design logic and coding practices that may allow, among other things, application users to exceed their privileges and manipulate the programs, or the ability to perform unauthorized transactions.
Infrastructure penetration testing assesses the external perimeter and internal infrastructure (and can include cloud services), and leverages the US CISA known vulnerabilities catalogue (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), among other sources. Frequent operating system and database updates and the failure to actively install new software patches timely poses a significant risk in this space.
Penetration tests are typically performed for one or the other topics, not both concurrently.
- Assessing your Current Toolset
If a penetration test is carried out in a vendor-agnostic fashion, they can help to improve the effectiveness of the tools under your current security umbrella. It can allow you to potentially adopt alternative toolsets and methodologies which could provide better functionality, along with reduced costs for the business.
- Making a Case for Security to the Board of Directors
While a penetration testing program which identifies no major issues is good news, one which identifies serious vulnerabilities can be leveraged with senior management and the Board of Directors to demonstrate the added value of the cybersecurity program to your organization. This helps make the case for funding the cybersecurity budget, leading to better security and greater operational resilience for your business and customers.
How can Obrela help?
Obrela’s proprietary penetration testing program is carefully tailored to client requirements to simulate specific scenarios as well as mimic and analyze different attacker’s methodologies and levels of knowledge. This allows Obrela to identify, document and provide to clients a comprehensive report of vulnerabilities, with clear recommendations on how to remediate them, allowing organizations to strengthen their security strategies. Through Obrela’s penetration testing program, we keep your business in business.
