Pros and Cons of Penetration Testing

Pen Testing is a crucial tool to protect organisations from cyber attacks. During a penetration test, a white hat hacker uses the same techniques, scripts and other tools to ethically hack the (digital or physical) surface of an organisation. The ultimate scope is to find vulnerabilities, weaknesses and gaps in the systems (even physical!) and applications, before a malicious actor exploits them.

The output of a pen test is a report with a list of recommendations for an organisation to fix or harden their systems. Penetration tests are a mandatory requirement for regulated businesses who hold licences or standards such as PCI DSS. In addition, such tests aid companies achieve compliance with ISO 27001 and GDPR. A professional cyber security partner should (always!) run pen tests as it is not a straightforward tick-box exercise.

When not running pen tests or running tests far apart, moreover when upgrading or introducing new systems – it is indeed a time bomb. Be proactive. Manage risk. Avoid running into problems of security breaches.

In this blog we look at the benefits of effective pen tests and any issues an organisation can possibly run into.

Pros of Penetration Testing

Identify vulnerabilities in a timely manner

Vulnerabilities expose organisations to devastating cyber attacks, which can harm the entity from various aspects. Knowing of vulnerabilities and therefore possible threats can help companies manage risk and mitigate it ongoingly.

Identify a myriad of small weaknesses that in their totality pose a serious risk

Small vulnerabilities may seem as negligible weaknesses. More often than not, they are enough of an opening for hackers to carry out their intrusion. Small security gaps can still lead to large security breaches. Overlooking small weaknesses can be suicidal. Automated security systems do overlook such weaknesses. Human led pen tests, replicate hackers’ methods therefore such entry points are pinpointed.

Recommendations and Advice

After carrying out the end-to-end penetration test, as a final step a report is presented which normally includes the discovered vulnerabilities and remediation advice. Tips to remediate the as-is situation are provided. These are organised by criticality and therefore by suggested priority. A presentation or meeting usually takes place, where the report is walked through and explained, and any clarifications ironed out.

Cons of Pen tests

Unprofessional pen tests can create serious problems

When penetration tests are not executed in a professional manner, a lot of damage can be created. Typical pitfalls when mimicking a hack attack include servers crashing, sensitive data being exposed and production data getting corrupted. All these have a direct adverse effect on an organisation’s cyber and information security health.

Lack of trust

Trust is essential when roping in a cyber security company to run a pen test. Pen testers are being let in your systems, networks and live environments. Abuse or lack of competence can both lead to unwanted outcomes. Get informed about the credentials of your pen testing partner. Understand their approach and procedures and make sure the right agreements and insurance cover are in place.

If unrealistic test conditions are present, results will be misleading

The best context for a pen test to happen is to surprise everyone. If stakeholders, such as employees know about the test, they are more likely to prepare and get their house in order prior to the test. If that happens the organisation will appear stronger than it actually is. Real life attacks come without warning, therefore it is always suggested that a pen test happens in a scenario where it is as close to real-life as possible.

If not run properly, a Pen test can disrupt operations. Other possible disadvantages include the creation of a false sense of security or the false alert fatigue. Time, effort and cost need to be seen as an investment. Pen tests can save the company much more funds, effort and time to remediate from a successful attack.

Our Pen Testing Approach

We organise our pen tests in 5 phases. A planning and goal setting stage kicks off the process, whereby the overall scope is agreed upon. Next in line is the scanning and analysis of the systems or applications – here the tester plans the attack. On completion of the plans, the attack stage follows, in which the tester tries to gain entry into the organisation’s system. The test is an exact replica of an attack.

In addition to exploitation, access sustenance is tried to see if access can be maintained for a number of days or even weeks. Concluding a test is the restoration of systems back to normal, covering of tracks and the preparation and presentation of an end-of-pentest report with advice for remediation.

All Cybergate’s pen testers were filtered during onboarding with a thorough background check carried out to be assured of their trustworthiness. The whole team of pen testers are certified and experienced. In addition, a set of cutting edge tools are utilised when carrying out ethical attacks, to emulate real-life attacks as realistically as possible.

Schedule your next pen test. Request a quotation.