Infrastructure security is a top priority for all IT managers. Organisations must be proactive in locating network vulnerabilities and resolving them, in order to prevent attacks that can cause system downtime, data loss, and damaged reputations.
Any type of security breach can have an impact and far-reaching repercussions for a company and its customers. Breaches open a company up to everything from lost consumer confidence to legal action. A study by PCI Pal during the last quarter of 2018 found that 62 per cent of Americans report that they will stop spending with a brand for several months following a hack or security breach.
It’s not just retail businesses that are at risk for security breaches. Facebook, T-Mobile, Quora, Google, Orbitz and British Airways were among the organisations attacked last year. While the security failures of large organisations are more likely to grab headlines, the likelihood of a breach is even greater for small businesses. And, experts say, the ability of a small business to fully recover from such an attack is much less than a large company with greater resources and deeper pockets. In fact, a staggering 60 per cent of small businesses that suffer a cyberattack go out of business within six months.
This is why comprehensive security testing techniques such as penetration testing are key to safeguarding every business’s infrastructure, especially given the increased number of proactive attacks on businesses in the United States.
What is penetration testing?
Penetration testing is an IT infrastructure security evaluation methodology that involves ethical hackers scaling planned attacks against a company’s security infrastructure to uncover and expose security vulnerabilities that need to be addressed. Pen testing is typically part of a holistic security strategy.
Pen testing looks for any vulnerabilities in your system that could compromise the confidentiality and availability of data. To do this, the test emulates a real attack in a controlled environment.
Testing looks for weaknesses in operating systems, services, networks or applications. In some cases, these vulnerabilities may be the result of improper configurations or risky behavior by end users. Whatever the cause, pen testing is an effective way to find issues before an outside hacker does.
A pen tester is, in fact, very similar to a hacker who is looking for loopholes and openings, but the difference is that the pen tester has permission to launch the attack with the end goal of identifying and eliminating the threat. However, it is best to have a pen test executed by someone with little-to-no prior knowledge of how the system is secured as they may be able to expose blind spots missed by those close to the system setup and how it works. Think of it as getting a second set of eyes on the system.
In addition to exposing system vulnerabilities, pen testing can also help determine how effective system defence mechanisms are and evaluate whether or not end users are following proper security protocol. Most testers will continue testing even after that first hole is discovered, which allows them to locate and fix any additional risks or threats that also may not be known.
Companies can gain useful and enlightening information via pen testing on actual security threats and vulnerabilities within the infrastructure. This allows business owners and IT managers to prioritise which security weaknesses are most crucial and should be addressed immediately. It also allows for the development of a plan of action for security weaknesses that may be less critical to operations or to determine which tests may have registered a false positive.
How is penetration testing performed?
A variety of penetration tests can be performed depending upon the system and its needs. They can be executed manually, automatically or as a combination of these two.
Using their tools, testers can systematically “attack” or compromise potential exposure points, including endpoints, web applications, servers, wireless networks, network devices, and mobile devices. After exploiting a discovered vulnerability, testers can use that finding to identify other weaknesses within the now-compromised system. In doing so, they can go deeper and discover access to more assets and data.
Once these vulnerabilities are exposed and identified, that information is made available to IT and network system managers. This now provides them the opportunity to identify next steps for resolution. Equipped with this information, IT professionals can determine how at-risk their infrastructure is and what consequences a similar attack from the outside would have on their resources and operations.
After the risks are identified, the next step is to look at how to safeguard assets from attacks. Some companies, including Aventis Systems, can not only identify the threats but also provide solutions that ensure that your infrastructure will no longer be vulnerable. As mentioned previously, if an outside service provider is used, you receive an unbiased look at your exposure and vulnerabilities.
Why is penetration testing so important?
The answer to this question is quite obvious: In today’s world, businesses can’t afford to allow data breaches. Being able to identify vulnerabilities and resolve potential danger areas before hackers do is critical to maintaining a safe infrastructure.
According to Verizon, 61 per cent of data breach victims are businesses with less than 1,000 employees. Further, Cybersecurity Ventures reports that a business falls victim to a ransomware attack every 40 seconds—something it predicts will rise to every 14 seconds by 2019.
No matter the size of your organisation, the time is now to implement proactive measures to protect you and your business. Not only can pen testing inform you of where network vulnerabilities lie, it can also provide other benefits. Pen testing allows a business to:
- Ensure compliance is met. Certain industries require annual and ongoing pen testing so that the enterprise can monitor and resolve vulnerabilities in the infrastructure. For example, the payment card industry has instigated a mandate to follow the PCI-DSS regulations for annual and ongoing penetration testing.
- Be prepared. Through pen testing, businesses can learn how long it will take for hackers to access data and can make sure security teams are able to prepare for such a threat.
- Verify security of system configurations. Having an outside, independent tester evaluate your system is an excellent way to measure the effectiveness of the security team as well as identify any existing gaps in the system.
- Provide security training for network staff. Such testing in a controlled environment provides a safe way to show network staff how to properly monitor for vulnerabilities and address them if they are identified.
- Test technology before implementation begins. By testing the technology prior to implementation, it is easier to find vulnerabilities and save the time and expense of resolving them after they go live.
How often should penetration testing be done?
Like all IT security precautions, penetration testing is something that needs to be conducted on a regular basis. Pen testing should be done at least once a year, although some internal pen testing might be required monthly. The frequency will depend on the type of test being done and the reason for the testing. This will help ensure more consistent IT and network security management by revealing newly discovered threats or emerging vulnerabilities that may potentially be exploited by attackers. In addition to regularly scheduled tests and assessments, testing should also be executed when the following situations occur:
- New network infrastructure or applications are added to the network
- Any significant upgrades or modifications are implemented
- New locations or networks are established
- After security patches are applied
- After modifications have been made to end-user policies
In these circumstances, pen testing will ensure that no new vulnerabilities have been created.
Tiffany Bloomer, President, Aventis Systems
Image Credit: Den Rise / Shutterstock
Gloss