We at ACSI, and other cyber security consultants, believe and always recommend our clients to practice penetration testing once a year, or every time a big change is bound to happen. But what are the exact reasons behind the annual penetration testing? This article is specially crafted–in a simple manner–for everyone who is still confused about penetration testing functionality and wants to do penetration testing on each of your organizations.
What is penetration testing?
Penetration testing, often shortened as pentest, is an activity where a cyber security services provider tries to find vulnerabilities in their client’s web application or mobile application. This can be done by hacking or penetrating the system, either automatically with tools or manually. Penetration testing is later divided into three categories by how much information the “hackers” have: black box, grey box, and white box.
Ranging from the loosest to the tightest information that the hackers can have, black box, grey box, and white box still serve the same goal, which is to find the vulnerabilities, or issues within the company or organization’s system, but the limited information might limit the findings of the deep-rooted vulnerabilities.
Penetration testing activity is often advised to be done annually or once a year, but it does not mean that the test cannot be executed more often. Situations like significant changes in system infrastructure, new features, business mergers, and so on, should trigger the need to do penetration testing to minimize system flaws.
What is the urgency?
In this section, ACSI will give out some reasons why annual penetration testing is necessary for companies or organizations:
- Changes in infrastructure
System infrastructure often changes throughout time, either by adding a big new feature or deleting unnecessary codes that have caused problems. This action can have big impacts on the system, and it might or might not create new vulnerabilities. It needs to be understood that as technology evolves, the scope of penetration testing should also follow.
- Company/organization’s growth
As the company or organization keeps growing, the possibilities of threats haunting its system also grow wider. A big company like Meta will likely receive cyber attacks more than a small micro business that is not known by a wide range of people. Although popularity does bring much bigger revenue, it also brings problems within.
- Incident response plan re-evaluation
By doing more than one penetration test in a year, a company or organization can use the findings to re-evaluate its incident response plan. In case an attack happens, and the company’s stakeholders think the current incident response plan is not effective, then a revision is needed.
- Investment
Pouring money into security services should not be seen as spending, but rather as an investment. The cost and effect of a cyber attack will be much higher than the cost of cyber security services. Applying cyber security services, like penetration testing is also a good work to build a secure reputation to attract customers or businesses.
So, does it really need to be more than once a year?
Not really, it all depends on your organization or company; what is the goal? What is your type of business? Because we do know that investing a lot of money on something digitally (or cannot be seen by the naked eye) is not something that many people are willing to do. If you are still unsure or want to know more, here are things that you need to pay attention to:
- Web or mobile application is crucial for business/organization
For businesses like social media or banking that rely a lot on their web or mobile applications, frequent penetration testing might be the correct norm. This is because their customers interact with their web or mobile applications a lot, and if the application is open to many vulnerabilities, it will lower their customers’ trust in the company.
- Compliance
Some companies that work in crucial sectors are often required to do some testing to ensure their safety. This request can either come from the government or the parent company
- Crucial sectors
Crucial sectors here may include banking, payment applications, social media, or any other company that stores a lot of their customers’ data. Making sure there are no vulnerabilities left in the system is important so no leakage happens.
TL;DR
It is important to remember that investing in cyber security, especially in this advanced technological society, is as important as having health insurance. Keeping your company and users’ data safe is an urgent matter to compete with other businesses. But before your company decides on doing penetration testing, we urge you to learn more about what types of penetration testing, and on what (cloud, hardware, server, etc.) to be tested.
Read our other works:
• Indonesia Upcoming 2024 Election Cyber Problems
• The Role of VPN in Cyber Security
• Which One Do You Need, VPN or DNS?
References:
