{"id":7929,"date":"2022-02-16T11:55:56","date_gmt":"2022-02-16T11:55:56","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7929"},"modified":"2022-02-16T11:55:56","modified_gmt":"2022-02-16T11:55:56","slug":"is-it-time-for-external-penetration-testing","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/is-it-time-for-external-penetration-testing\/","title":{"rendered":"Is it time for external penetration testing? Finding the right time for software security testing"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7929\" class=\"elementor elementor-7929\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">Your business is up and running. Your first product is ready for release. But wait, have you verified its security with external penetration testing?<\/span><\/p><p><span style=\"font-weight: 400;\">Fast forward a year, and you are happily getting on with day to day business. Business is growing, new systems are coming online, upgrades are being made to your product. But wait, when was the last time you checked your application and infrastructure with external penetration testing?<\/span><\/p><p><span style=\"font-weight: 400;\">You\u2019ve finally taken the first steps to digital transformation. The cloud is all set up, and you are ready to turn off the on-prem servers. But wait, do you really know that everything is secure? Have you verified your cloud\u2019s security with third party penetration testing?<\/span><\/p><p><span style=\"font-weight: 400;\">Third party <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/application-security\/penetration-testing\/\"><span style=\"font-weight: 400;\">penetration testing<\/span><\/a><span style=\"font-weight: 400;\"> is one of the most potent software security tools available to your organisation, allowing you to verify that your newly developed application, new system, or entire <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\"><span style=\"font-weight: 400;\">network<\/span><\/a><span style=\"font-weight: 400;\"> is secure.<\/span><\/p><h2><span style=\"font-weight: 400;\">What is penetration testing?<\/span><\/h2><p><a href=\"https:\/\/outofsite.biz\/cynance\/application-security\/penetration-testing\/\"><span style=\"font-weight: 400;\">Penetration testing<\/span><\/a><span style=\"font-weight: 400;\"> (also known as pentesting, or ethical hacking) is an assessment of an organisation\u2019s security posture.<\/span><\/p><p><span style=\"font-weight: 400;\">In external penetration testing, ethical hackers from outside your organisation will \u2018hack\u2019 into your systems (with your permission). The penetration testers carry out a simulated attack on the network, application, or system mimicking the attack methods used by cyber criminals in order to test the defences you have in place, and find any weaknesses that could compromise your security.<\/span><\/p><p><span style=\"font-weight: 400;\">Penetration testing can be carried out on an <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/application-security\/penetration-testing\/\"><span style=\"font-weight: 400;\">application<\/span><\/a><span style=\"font-weight: 400;\"> (software), or <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\"><span style=\"font-weight: 400;\">networks<\/span><\/a><span style=\"font-weight: 400;\"> (infrastructure), including <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/cloud-security\/\"><span style=\"font-weight: 400;\">cloud infrastructure<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p><p><span style=\"font-weight: 400;\">External penetration testing is a security best practice for organisations of all sizes, in all industries. For companies who develop applications of any type, software security testing through penetration testing is a must have.<\/span><\/p><h2><span style=\"font-weight: 400;\">Why is external penetration testing important?<\/span><\/h2><p><b>Identify vulnerabilities in systems, infrastructure, and applications<\/b><\/p><p><span style=\"font-weight: 400;\">Penetration testers will simulate the techniques used by hackers, providing an all-around picture of the real-world attack vectors facing the organisation, and whether there are any security vulnerabilities in systems, application configurations, and infrastructure.<\/span><\/p><p><span style=\"font-weight: 400;\">Just some of the vulnerabilities that penetration testing will check for are:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Weaknesses in infrastructure<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Vulnerabilities in the operating systems, services, and applications used across the organisation<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Incorrect system configurations<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Logic flaws in application processes<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Weak credentials<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Out of date systems and poor security processes<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">The penetration testing team will actively hunt for weaknesses, getting a full picture of the system in the test, and searching for new or unidentified vulnerabilities.\u00a0<\/span><\/p><p><b>Provide risks for prioritisation<\/b><\/p><p><span style=\"font-weight: 400;\">The penetration testing team will provide information about how easy it was to exploit the vulnerability, and a risk assessment of the potential impact should it be exploited by a malicious actor.\u00a0 This assessment in turn will enable those responsible for security to prioritise risks and create a plan for mitigation.<\/span><\/p><p><b>Provide verification of security for management<\/b><\/p><p><span style=\"font-weight: 400;\">Third party penetration testing provides an impartial view of the organisation\u2019s security posture which can be used to inform senior management about security risk, and provide evidence of how well the organisation is protected against cyber attack. In turn this will drive discussions about strategy and resources.<\/span><\/p><p><b>Meet industry and regulatory requirements<\/b><\/p><p><span style=\"font-weight: 400;\">Many regulations and industry standards (including HIPPA, PCI DSS, and NIS) place responsibility on organisations to protect their data. Third party penetration testing is a recognised software security tool which allows organisations to demonstrate that they have done just that. Other frameworks such as the <\/span><a href=\"https:\/\/www.iso.org\/isoiec-27001-information-security.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">ISO 27001 framework<\/span><\/a><span style=\"font-weight: 400;\"> actively require external penetration testing for certification.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">As a further incentive, regulations such as the <\/span><a href=\"https:\/\/ico.org.uk\/for-organisations\/guide-to-data-protection\/guide-to-the-general-data-protection-regulation-gdpr\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">GDPR<\/span><\/a><span style=\"font-weight: 400;\"> have the power to levy fines on organisations who don\u2019t sufficiently protect their customer\u2019s data. External penetration testing is therefore a way of preventing a breach, or providing evidence of security activity in the event of a data privacy breach.<\/span><\/p><p><b>Meet customer security expectations<\/b><\/p><p><span style=\"font-weight: 400;\">Supply chain security is an area of increasing concern for many organisations. Customers are beginning to specify the security standards they expect from their suppliers in their contracts, including evidence of penetration testing, and a plan for external penetration testing going forward.<\/span><\/p><p><b>Promote secure development<\/b><\/p><p><span style=\"font-weight: 400;\">External penetration testing is a key component of a <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/application-security\/secure-software-development-life-cycle-ssdlc\/\"><span style=\"font-weight: 400;\">secure software development lifecycle<\/span><\/a><span style=\"font-weight: 400;\">. Even the most conscientious of developers need validation from others that their code is secure. In addition as the application is updated and new functionalities are added, vulnerabilities can creep in.<\/span><\/p><p><span style=\"font-weight: 400;\">Regular penetration testing will test the code for vulnerabilities, potentially identifying vulnerabilities the developers weren\u2019t even aware of, and ensure that the overall application is secure.<\/span><\/p><h2><span style=\"font-weight: 400;\">When should organisations carry out external penetration testing?<\/span><\/h2><p><span style=\"font-weight: 400;\">The general guidance is that organisations should plan to conduct external penetration testing on a regular basis. \u201cRegular\u201d may mean different time frames for proprietary applications, purchased systems, and the wider infrastructure and network. Some of the variables that will feed into an external penetration testing programme include:<\/span><\/p><p><b>Recurring or annual routine penetration testing<\/b><\/p><p><span style=\"font-weight: 400;\">External penetration testing is part of a technical systems audit, ensuring that all updates have been carried out, that new software has been applied correctly, that updates to your own applications have not compromised security, and so on.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">If nothing has changed (and let\u2019s face it, things always change), the basic timeline should be an annual security health check up. The cyber security landscape changes very quickly, and annual <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/application-security\/penetration-testing\/\"><span style=\"font-weight: 400;\">third party penetration testing<\/span><\/a><span style=\"font-weight: 400;\"> will ensure that systems are validated against the most current of attack vendors, some of which may not have been around the previous year.<\/span><\/p><p><span style=\"font-weight: 400;\">However there may be requirements to carry out external penetration testing more often. Regulations may instruct organisations to carry out testing more than annually. Or the organisation may decide that critical infrastructure should be tested more frequently. In those cases, there may be a rolling schedule of external penetration testing over the course of a year.<\/span><\/p><p><b>Before a new application is deployed<\/b><\/p><p><span style=\"font-weight: 400;\">The timing for <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/application-security\/penetration-testing\/\"><span style=\"font-weight: 400;\">external penetration testing for new applications<\/span><\/a><span style=\"font-weight: 400;\"> can be tricky. On the one hand, it is more cost effective and productive to carry out penetration testing before an application enters production. However, test too early and there will be too many changes to the application that will not be included in the scope of the test. However the rule of thumb is when there is a stable product, but that there is time to mitigate any major findings without delaying the launch.<\/span><\/p><p><b>When a new system or equipment is introduced to the network<\/b><\/p><p><span style=\"font-weight: 400;\">Every new application, website, system, or service adds a new attack surface to the network. As a result, whenever a new system is added to the network, the <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\"><span style=\"font-weight: 400;\">network should be verified<\/span><\/a><span style=\"font-weight: 400;\"> with external penetration testing to ensure that the new system does not introduce new vulnerabilities to the network.<\/span><\/p><p><b>When major changes are made to the network<\/b><\/p><p><span style=\"font-weight: 400;\">A major change can include updating a specific system, a change in the architecture\/ design of the network, carrying out a <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/cloud-security\/\"><span style=\"font-weight: 400;\">digital transformation to the cloud<\/span><\/a><span style=\"font-weight: 400;\">, updating firewall rules, and more. Each of these changes come with their own vulnerabilities, and upgrades to an existing system that has been tested many times over the years can also introduce new risks. Every new change to the network should be subjected to external penetration testing before the change is exposed to the internet.<\/span><\/p><p><span style=\"font-weight: 400;\">Ultimately, if you are asking if now is the time for external penetration testing, then it probably is. External penetration testing is one of the most useful security tools at any organisation\u2019s disposal as it verifies the organisation\u2019s security posture, identifies risk for the organisation, and informs the information security programme.<\/span><\/p><p><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Your business is up and running. Your first product is ready for release. But wait, have you verified its security with external penetration testing? Fast forward a year, and you are happily getting on with day to day business. Business is growing, new systems are coming online, upgrades are being made to your product. But&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7946,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7929"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7929"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7929\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7946"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7929"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7929"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}