By Min Pyo Hong, CEO and Founder, SEWORKS
There are as many reasons for businesses to routinely conduct penetration testing on IT infrastructure as there are new malware and cybersecurity threats that, unfortunately, seem to pop up every day.
Reading news accounts of damages brought about by the WannaCry and NotPetya malware attacks is an impetus for many organizations. For others, penetration testing is a business imperative. Does your business have compliance requirements under HIPPA rules or the Payment Card Industry Data Security Standard (PCI DSS)? The European Union’s General Data Protection Regulation, or GDPR, took effect in May of this year, and British Airways is already one of the first high-profile companies to suffer a data breach. It may only be that your corporate network is running slow at times or there have been unexpected reboot events.
Automated security testing tools have come a long way, with more comprehensive exploit libraries and the improved ability to detect network and application vulnerabilities. Reports are produced automatically, and the tools themselves don’t require extensive professional security researcher expertise.
However, conducting penetration testing via simulated attacks on your organization's network is the best way to help your business evaluate the strength of your network security protocols and identify any backdoors, weaknesses, and gaps between different security tools, and prioritize risk.
But when it comes to evaluating the appropriate penetration testing solution for your business, the choices can be opaque. InfoSec professionals should keep in mind there are four primary factors to consider when it comes to evaluating penetration testing resources.
1. Security Expert or DYI?
Some businesses attempt to handle security testing in-house, but the process is not easy for just anyone to execute and there are a limited number of available security experts. For the most part, companies rely on traditional automated vulnerability scans, even though in-depth penetration testing is necessary to evaluate the security status properly. However, skill levels vary among pen testers, and it can be challenging for a business to find a reliable pen testing resource unless they have a trusted referral. Costs vary as well, so it’s important to carefully define the scope of a security project and obtain several quotes. Yet another consideration is reporting capability since the time spent compiling reports can be extensive. Always ask to see sample reports to ensure the findings are prioritized and can be easily understood. With advances in artificial intelligence, AI-based penetration testing is now a highly reliable and affordable option for security. Human error is minimized, and reporting is faster.2. What About Leaks of Confidential Information?
There’s really no way to test a human pen tester’s ethics beforehand, but the trust of any third-party is vital. A human pen tester handles sensitive and proprietary data and if the information gathered is leveraged for malicious purposes, your company may end up facing serious criminal charges, as well as financial penalties.3. Is Extensibility More Important Than Expertise?
Extensibility in security tools enables existing functionality to evolve and expand over time to identify future threats. A true expert human pen tester is a valuable resource, but there are inevitably times when a fresh approach is beneficial. The nature of artificial intelligence means that AI pen testing gets “smarter” as it evolves rapidly in pace with the changes in security trends. Every day, new security threats and breaches are discovered. Moreover, there are still so many unknown security vulnerabilities that can bully organizations. Security expertise can help catch up with such changing trends, but utilizing AI will make this process much faster. For instance, an AI engine specifically designed for security can use machine learning technology to keep up with the newest security findings and implement them to improve the security status.4. Does Speed Matter?
The answer is maybe. When it comes to detecting security vulnerabilities, numerous automatic scanning tools are every bit as fast at identifying vulnerabilities as human and AI pen testing. But keep in mind that pattern-based, automated scanning tools may not differentiate between genuine vulnerabilities in a field environment and errors or bugs that appear to be vulnerabilities, but in actuality are not. Automated scanning tools are fast, generating reports of perhaps several hundred pages, but they also have a high false positive rate, which can be inefficient and inconvenient. Once AI pen testing is completed, a report is automatically generated, usually within an hour or so. Compiling reports from human pen testing obviously requires more time. Best Security Defense: Think Like a Malicious Hacker Data breaches are costly concerning downtime, loss of funds, customers and reputation. Today’s information security best practices must go beyond firewalls, antivirus software, and encryption to regularly test security systems and processes. “The best defense is a good offense” applies to many fields and is especially appropriate when it comes to the security of your enterprise network. Keep in mind that every environment is different and has different security vulnerabilities, but when your business could be affected by malicious hackers that are growing more formidable, it’s time to take a pro-active approach to security. Maybe it’s time to think like a hacker and leverage the white hat hacker’s offensive strategy – penetration testing by deep learning algorithms and artificial intelligence.Interested in learning more about this topic? Then you'll definitely want to visit MISTI's upcoming InfoSec World Conference & Expo in Orlando, Florida.
