Penetration testing is more important than ever for any business, but, whether you’re part of an internal team or an external consultancy, it’s easy to get into a rut of making the same mistakes. At times, these mistakes can be at the reporting phase, which can have a knock-on effect when it comes to ensuring stakeholder buy-in. Other times, mistakes and oversights can happen during the test itself.
Either way, sharpening your approach will produce better results and safer clients.
Fragmented data
An effective pentest requires so many different tools, such as Burp Suite and Nmap, that it’s very easy for a single test to generate a huge wealth of scattered data. Not only does this increase the likelihood of an oversight, but it also contributes to the amount of time you will spend on reporting (more on that below).
By working through a consolidated, purpose-built platform that brings all the findings from your pentesting tools together, under one roof, you can reduce time while also improving the overall presentation of your findings. Think of it like having all your ingredients around you when you are cooking, rather than having to run off to the other end of the kitchen at each step in the recipe.
Excessive time spent on reporting
Reports are the vital output from a pentest, but there is far more value to be found in investing time into the pentest itself. Yes, the report needs to clearly display all findings and necessary action, but teams can easily burn the lion’s share of their testing time on the writing.
Automating report generation is fundamental to ensuring you have enough time to give to the pentest. With the right pentesting tools, however, it’s possible to automate the process of turning findings into clear and actionable reports, saving a massive amount of time and allowing it to be redirected back into the specialised aspects of the test.
Forgetting about the human element
Vulnerabilities in the system architecture itself are one thing, and it’s easy to home in immediately on those ‘quantitative’ vulnerabilities and forget about those that would be considered qualitative. In other words, it’s easy to forget about the people who actually work within these systems all day, every day, since every single one of them holds a key to the front (and back) door simply by virtue of having an email address, or working on the company platform.
Any effective pentest will acknowledge that the individuals working for a company represent a constant vulnerability, and will deploy effective testing directed their way – for instance, phishing and vishing attempts.
Social engineering is a key part of the puzzle, but it’s easy to overlook it – particularly when there are already glaring vulnerabilities in the company’s digital infrastructure. True, most stakeholders don’t want to hear that their employees are one step away from giving their password to an unknown entity, thinking they’re a CEO or supervisor, but it’s far better to know so that appropriate training can be undertaken.