Not every penetration test is thorough enough. Here are 10 things to look for in a penetration test, from passive reconnaissance to risk ratings, so you get the complete assessment you paid for.
Mature penetration testing is becoming a staple assessment for many organizations as more regulations require third-party assessments and organizations perform their own due diligence reviews.
Unfortunately, penetration testing is becoming a bit of a commoditized service as more and more organizations enter this space. The price range for these services varies wildly and, consequently, so does the quality.
I recently saw five different firms bid on the same project. The prices ranged from $15,000 to $40,000. Cost plays a significant role in the decision-making process. I encourage you to thoroughly evaluate the quality of the work being proposed.
What Should You Look for in a Penetration Test?
A mature penetration test goes beyond a vulnerability scan. It starts with careful reconnaissance, uses the right tool for each finding, and ends with a report your team can act on. Look forthe following to ensure you are getting the well-rounded, mature penetration test you deserve and are paying for:
1. Passive Reconnaissance
In the interest of time, many firms will consider a port sweep reconnaissance and skip passive forms of reconnaissance. Passive reconnaissance is pertinent to future phases of the assessment and to identify additional risks facing the organization.
2. A Robust Suite of Tools
Mature penetration testing is so much more than simply running your favorite vulnerability scanner. You should identify the specific tool used to identify and exploit each vulnerability. While Metasploit is a great tool and is useful in many circumstances (no need to reinvent the wheel, right?) the list of tools should include more than just NMAP, Metasploit, and Nessus.
3. A Realistic and Inclusive Scope
Take the time to properly scope your penetration test and try to prevent limiting tests over systems with sensitive data. The report should clearly outline limitations imposed by the organization or otherwise. If certain tests aren’t performed, you risk leaving vulnerabilities undiscovered. The report should clearly call limitations out so not to provide a false sense of security.
4. Specific Metrics
In our experience, we have found that management deals in numbers. The ability to tie the results of a penetration test to specific metrics enables the penetration testing team to more effectively communicate with management. Bonus points if the penetration testing team can compare the results to industry peers and provide a comparative metric.
5. Strong Collaboration and Communication
At the end of the day, the penetration testing team is a partner and an ally. They seek to strengthen your organization’s security by identifying exploits before they are exploited by a malicious entity. This is a difficult balance to achieve, but the penetration testing team should work alongside the organization in support of this common goal. This may mean additional meetings, additional deliverables, and transparency between the two teams.
6. Valuable Report Format
From time to time, I get to work on a risk assessment or review a penetration test report written by another firm. Sometimes they are great! Other times, they are not. The number of firms that deliver clunky reports shocks me. They are not only difficult to read and understand but also difficult to work with. The report must be usable.
7. Multiple Deliverables
Ensure the deliverable package meets your unique needs. This may mean deliverables are tailored for easy import into Governance, Risk, and Compliance (GRC) tools or additional deliverables are created (within reason). The deliverables package should include all supporting evidence (screenshots, tool outputs, recordings, etc.) from the assessment, time with the penetration testing team to inquire into specific vulnerabilities, and an executive summary explaining the results at a high-level for management teams and board members.
8. A Usable Narrative
This should be a no-brainer, but the report must accurately depict the assessment and tests performed with enough detail that a reasonably, well-versed security engineer could re-create the assessments as needed. Anything less is simply a vulnerability scan.
9. Actionable Recommendations
The recommendations created as a result of the penetration test should be direct and actionable and maybe even provide a way to validate remediation efforts internally. Where recommendations may impact business operations, the penetration testing team should be able to provide work around recommendations.
10. A Standard Methodology
Mature penetration testing frameworks and methodologies exist for a reason; they work and are repeatable. Like the Scientific Theory or Troubleshooting Theory, there must be a logical sequence of events to follow to identify vulnerabilities. Not following a matured, published framework or methodology is like throwing darts at a wall and seeing where they stick. Organizations can have a proprietary or mesh methodology, so long as they are following a methodology. Common published options include the Penetration Testing Execution Standard (PTES), NIST SP 800-115, and the OWASP Web Security Testing Guide.
Finally, as a bonus:
11. A Solid Risk Ranking Model
Risk ratings are hotly debated subjects, in part because executives and board members are more heavily invested in security than in the past. Risk ratings may also drive individual or department performance reviews and budgets.
There are many ways to calculate and assign risk levels to vulnerabilities, but we recommend using an objective and repeatable method. This will provide proper forethought into the vulnerability as well as justification for how that risk was concluded. This can be a proprietary formula or an open formula such as the Common Vulnerability Scoring System (CVSS) version 4.0 or Open Worldwide Application Security Project (OWASP) risk calculator.
Final Thoughts on a Successful Penetration Test
Budgets are tight and security budgets are even tighter. Board members and management are starting to take security seriously. Don’t waste your hard-fought budget on a sub-par assessment.
Wonder what a cyber attacker sees when they target your organization? Wonder no more. Watch a live network attack demo simulated by an industry-leading offensive security expert. In our on-demand webinar, you’ll learn how to uncover vulnerabilities that the average pen test misses.
