A penetration test shows how secure your systems were at the time of testing, but most businesses change a fair amount from one year to the next. Testing is often arranged because a contract, an audit or a new project requires it, so it’s common for the most recent report to be out of date without anyone noticing.
What is a penetration test?
A penetration test is a controlled, authorised attempt to find and exploit weaknesses in your IT environment, using many of the same techniques as a real attacker. The testers check whether those weaknesses could be used to access your systems or data, how far someone could get once inside and which problems need fixing first.
This is different from a vulnerability scan, which checks your systems against known issues and flags potential weaknesses. Scans are useful for routine checks, but a penetration test goes further by trying to exploit what it finds, sometimes combining several issues to see what an attacker could achieve. The report then sets out what was found, how serious each issue is and what needs to be done.
Tests can be scoped to suit what you want to assess. An external test looks at what can be reached over the internet, while an internal test looks at what an attacker could do from inside your network. Individual websites and applications can also be tested, particularly those that handle customer information or payments.
How often should you test?
For many organisations, testing once a year is a sensible starting point. Software updates, new devices, new users and configuration changes can all introduce vulnerabilities over the course of a year, even when nothing major has changed. Businesses that handle large amounts of sensitive information or make frequent changes to their systems may need to test more often, and any contractual or regulatory requirements should also be taken into account.
When should you arrange another test?
You don’t always need to wait a year before testing again. If your environment has changed significantly since the last test, some of the findings may no longer apply and new vulnerabilities may have been introduced.
Changes to your infrastructure are one of the most common reasons to test again, such as moving systems to the cloud, replacing firewalls or network equipment, opening a new site or restructuring your network. Testing once the work is finished confirms that the new setup is secure.
New online services are another. A website, customer portal, mobile app or remote access service can introduce its own vulnerabilities, so it’s best to test before launch or shortly after.
Changes in the business can also affect security. Growth or a move to hybrid working can mean more people and devices connecting to your systems, and a merger or acquisition may bring in another organisation’s IT without a clear view of how secure it is.
After a security incident or near miss, a penetration test can confirm the issue has been fixed and check for similar vulnerabilities elsewhere.
When customers, insurers or compliance require it
There may also be outside requirements to consider. Organisations handling cardholder data may have penetration testing obligations under PCI DSS, including regular testing and further testing after significant changes, depending on the requirements that apply to them. Those working towards ISO 27001 may also use penetration testing to check that their security controls are working.
Some cyber insurers ask how often a business tests its systems, and larger customers may ask suppliers for evidence of recent testing, particularly where sensitive information is involved. Having a recent report makes these questions much easier to answer.
Not sure where you stand?
You don’t need to know what kind of testing you need, or when your last test took place, before speaking to us. Italik works with WorkNest to deliver penetration testing, and our team can review your current IT environment and help you decide what to test and when. Once testing is complete, we can also help you understand the findings and fix any issues.
Need a clearer picture of your security? Speak to Italik.