Penetration tests find security vulnerabilities before hackers do and are critical for keeping organizations safe from cyber threats.
You can either create your own pentesting program or hire an outside firm to do it for you. Penetration test services have become common, with many security companies offering them. But they can be expensive and should be done often, so if you have the expertise on staff, consider developing your own penetration testing program. The result will be greater control over this important vulnerability and risk management process, and a more knowledgeable and prepared security staff.
Once you’ve decided to put together your own pentesting team, the first step is to create a plan that assesses your most critical assets so you can secure them.
See the Best Penetration Testing Tools and the Top Open Source Penetration Testing Tools
Table of Contents
How Does a Penetration Testing Program Work?
Penetration testing differs from vulnerability scanning by using human pentesters to probe for vulnerabilities as hackers would.
During penetration tests, security experts, also known as ethical or white hat hackers or “red teams,” simulate real attacks on a system. The simulations are designed for testers to identify vulnerabilities, errors, or weaknesses in network infrastructure before an attacker can exploit them. Known as an offensive security approach, penetration testing keeps organizations one step ahead of cyber criminals.
A penetration testing program goes beyond individual penetration tests and outlines a blueprint for an organization to follow. The program answers what, when, why, and where tests should run. Penetration testing programs should be ongoing, detailed, scheduled and revised as needed.
The program should define a series of pentests to identify and remediate vulnerabilities in a system. Security leaders will know how many penetration tests to run as well as where and when to run them because the penetration program has been outlined. Even if an organization outsources all of its penetration tests, the program will provide a clear route when engaging with a vendor, a bug bounty program, or white hackers offering penetration testing as a service.
Also read: Penetration Testing vs. Vulnerability Testing: An Important Difference
10 Steps for Building a Penetration Testing Program
In penetration testing, preparation is key. Asking vendors to run random tests against a system will not provide the information needed to evaluate and remediate flaws and improve performance and security.
It is essential to know the inside and out of penetration tests and what you expect to achieve. Designing a penetration test program can be overwhelming. Here are 10 simple steps that can guide you through the process.
1. Secure budget and human resources
While penetration tests are cost-effective and have important benefits, organizations must first secure the budget and ensure they have the human resources to run them. Because tests should be ongoing for a long time, this should be the first step an organization takes. Organizations must make sure they have all the resources they need to get them through the program.
2. Assemble a penetration test program team
The first thing an organization should do, even before starting to build the program, is finding the right team and talent. Define roles and responsibilities and ensure the team members have all the necessary skills and certifications. The team will also need to work with other departments and management to build the program.
As you assemble your team and think about your objectives, think about the tools you’ll need for your pentest targets, and find or train staff to run those tests. Think about the possible attack paths and important assets to protect, like Active Directory or a critical application database or code repository, and then decide on the tests you need to run to test their security.
Also read:
- Red Team vs Blue Team vs Purple Team: Differences Explained
- Testing & Evaluating SIEM Systems: A Review of Rapid7 InsightIDR
3. Map the digital surface, and build an asset inventory
The penetration testing team should comprehensively map the entire digital infrastructure, networks, Internet of Things (IoT) devices, edge, and cloud resources. Additionally, the map should include a data and asset inventory with all relevant information about the data cycle, from input, generation, and gathering to distribution, sales, and disposal of data.
A clear vision of the entire system helps to quickly identify where each component is located and provides a birds-eye view of what needs protecting. Make a note of future projects and include them in the map and inventory.
4. Define business objectives
Like any other program in operations, pentesting should be aligned with the business’s mission, goals, and targets. Focus on assets critical for operations, such as a customer database or critical application. Business objectives may change over time and require revision. Therefore, the team must come back to this point as penetration tests are executed over time.
5. Set asset priorities
Business objectives may be to increase sales, adjust to the economic slowdown, pivot disruptions, or prevent customer churn. Whatever the company’s objectives are, the security of the assets that drive their outcomes must be guaranteed and tested.
Identify asset priority using the data inventory and digital surface map. If there are future projects in development that are critical, make sure to include them.
Pentests can be done by brute force, or a black box approach, simulating an attack where hackers know nothing of your systems, or a white box approach, where they have knowledge of your system architecture. A blend of the two is called a gray box approach.
A brute force attack simulation would involve probing your network, web applications and users for weaknesses, while a white box approach might use sophisticated code analysis to probe an application for weaknesses.
6. Set level priorities
Your company will be running several periodical tests lasting several days or longer. Now that there is a clear idea of what needs to be secured, set priorities for tests that need to happen first and those that follow down the line.
Additionally, running tests can be expensive, so consider spreading out tests for different systems depending on the priorities. Priorities usually include tests that check:
- Vulnerability exploitation
- Code execution
- Lateral movement
- Data exfiltration
- Application vulnerabilities
- Input validation
- Authentication
- Authorization enforcement
- Vendor trust and supply chain security
7. Define the type and number of tests, and schedule them
As a company expands into the digital world, its data, systems, networks, and digital assets will evolve. Penetration tests can only provide a view of a company’s IT infrastructure at a specific moment.
However, when designing a penetration testing program, companies can schedule yearly, quarterly, or monthly penetration tests to protect their systems over time as they change. Additionally, it’s important to know how penetration tests work, including their phases and types, to understand which ones to run, while always focusing on identified asset priorities.
Also read: Penetration Testing Phases & Steps Explained
8. Establish communication channels and awareness
It’s critical to establish clear communication channels. Penetration testing should not be siloed and limited to IT and security teams. Executives, data engineers, developers, content creators, marketing and sales, production, and distribution teams should all be aware of the program.
Penetration tests are all about learning about errors, misconfigurations, and weaknesses. Therefore, every worker may have a role to play in improving security. Feedback is always encouraged to create a strong security culture.
9. Choose penetration testers, and run the tests
Penetration tests can be run in-house, through a vendor, through bug bounty programs, or through organizations that offer penetration tests as a service.
Each method has its pros and cons. While in-house tests allow for complete control, a team of experts is needed to execute them. On the other hand, outsourcing penetration tests can be expensive, depending on the vendor or program, but organizations can also increase the diversity of talent and resources with this option. In the end, it comes down to an organization’s resources, the importance of its data, and the level of confidence in security controls.
10. Reporting, remediation, monitoring, and restarting
A penetration testing program does not end when tests conclude. Each test should reveal vulnerabilities and recommend patches and remediations. Fixing vulnerabilities is the most direct goal of penetration testing.
Reporting, remediation, monitoring, and retesting take time and are essential; otherwise, you are just identifying weaknesses but not fixing them or checking to see if patches and mitigations were applied. This stage is critical to improving an organization’s learning and performance curves at all levels.
It’s also essential to revise and adjust the program after every test and after the entire scheduled series of tests are completed. Simply put, step 10 is not the end; it is followed by a restart and step one.
See the Best Patch Management Software & Tools
Teams to Involve in the Pentesting Program
No penetration testing program will be successful if it only includes security teams and IT departments. An organization’s digital attack surface extends to every aspect of its operations.
Boards and leaders need to know about security to make informed business decisions, developers need to learn from errors, and even the human element of security will be involved in simulated phishing attacks during penetration tests. Therefore, everyone should have some role in the program, depending on their contribution.
It’s also important to understand that some penetration tests may simulate attacks but never disclose to the company what they will be attacking or when. These blind attacks try to get as close as they can to real-world scenarios to test security teams’ response performance and time — something closer to red-and-blue teaming.
Hackers will also run attacks attempting to steal credentials from workers as cyber criminals do. If workers are informed about these simulations, the results of the tests will not be realistic.
Engineers and product teams need to be mainly involved in the program’s reporting, remediation, and monitoring phases. Just like security teams, they will learn from simulations and improve their work.
Executives can better understand the risks, consequences, and state of their security with penetration tests. This helps create a top-to-bottom security culture and common understanding that facilitates daily cybersecurity operations.
Bottom Line: Starting a Pentesting Program
Even if you choose to outsource your pentesting program, you should still take the time to develop a pentesting program. It will make your security team and business managers better informed, and will also guide discussions with vendors and service providers.
A penetration testing program goes beyond identifying weaknesses before criminals can detect them and use them against you. It provides a vision of the organization’s performance, security, awareness, and culture and can help you achieve business targets and goals. You need to know what’s critical before you can figure out how to protect it.
Read next: What is Cyber Threat Hunting? Definition, Techniques & Steps
