Need a Penetration Test? Here’s What to Do Next

Originally published by Schellman.

In our experience, there are typically three reasons why you may move forward with a penetration test and start looking around for a provider. Making that initial decision to move forward with an assessment like this is a big step, but what should you do after you make it?

If you fall into any of the following common scenarios that mandate a pen test, here are the immediate next steps to take for each one:

1. You want to proactively improve your cybersecurity
2. You need to satisfy a client request
3. You need to meet compliance requirements

1. What to Do Next When You Need a Penetration Test for Improved Cybersecurity Purposes

If you’re already performing external network, authenticated web application, and authenticated internal network vulnerability scans, a penetration test can be a great and natural next step in building a more mature security posture for your organization.

Once you decide to take this step, you then need to decide the scope—or, what you want to test. Knowing what kind of test(s) you need should then help streamline your subsequent search for vendors.

Do keep in mind though, that a solitary penetration test likely won’t suffice as your organization and products evolve—while your cadence can vary, you should expect to repeat this process more than once to achieve optimal cybersecurity.

2. What to Do Next If Your Client Requested You Perform a Pen Test

Of course, if you’re pursuing a pen test due to a client request, they likely already know exactly what kind of test they want—and if not, you shouldn’t move forward with a vendor until you do understand the specific nature of your client’s request.

You need to know what part of your environment your client wants examined, as there are many different attack vectors you can have tested:

• Web Application
• Application Program Interface (API)
• External Network
• Internal Network
• Social Engineering (Phishing/Vishing/Smishing)
• Mobile Application

Once you know what they want, you can then use a scoping questionnaire to drill down even more specifically to better determine the level of effort and resources that this engagement will take (and search for vendors that can perform what you need).

3. What to Do Next If You Have a Compliance Requirement for a Pen Test to Be Performed

In a similar vein, you may be in the market for a penetration test because a compliance standard you’re being asked to adhere to calls for one. If that’s the case, the good news is that most compliance frameworks have strict requirements as to what should be included in the scope of its requisite penetration test, with the two major being:

• PCI DSS
• FedRAMP

Your next step, then, is to familiarize yourself with those strict requirements of the particular standard you’re seeking to comply with so that, when you do engage a penetration tester to perform the work, you can work more closely and knowledgeably with them to ensure you’re meeting all the requirements necessary to achieve your compliance initiatives.

Other Important Penetration Test Considerations

No matter what scenario you fall under, you’ll need to accommodate your penetration test within your daily operations, which means understanding—at least roughly—how long your tailored assessment will take, and several factors can affect the duration of your penetration test.

Similarly critical will be the overall scheduling and timing for your penetration test, which is more complex than you may anticipate—together with the anticipated duration, it’ll be important to understand what constraints you have, be they compliance requirements or otherwise, so that you ensure you leave yourself plenty of time to accommodate the test, including any time that may be necessary for retesting.

And finally, you’ll also need to set aside funds for a penetration test. Just as with timing and duration, your price will depend on various factors, and this article breaks down the different considerations for different types of penetration tests so that you can more easily gauge your possible costs.

Having a penetration test performed is a solid step, whether it moves you closer to bolstering your cybersecurity, satisfying client requests, or meeting compliance requirements. Now that you have your next steps, as well as further details on common considerations, you can more easily set expectations for your organization going forward.