With our experience gathered in multiple customer projects we observed multiple times a huge value potential for businesses utilizing pen-testing services for their cybersecurity targets.

While executing software development or standard software integration projects together with customer teams, we had engaged with information security and data protection colleagues to comply with the company regulations and policies as well as keep the systems secure. These interactions were based on the past knowledge of the system checks and in most cases there was no time or capacity to refresh the actual status of the protection.
The main challenge of having an actual status of software protection is usually a high effort executing security checks, containing long lead time and extensive coordination and clarification rounds with the experts. This resulted in spending vast amounts of time to get the check results including their interpretations and security measure recommendations.

Challenges with automated pen-testing

Even though there is quite an amount of automated pen-testing offerings, utilizing them still requires a lot of effort and time. These are the major effort and lead time drivers:

• selecting which of the pen-tests are the most suitable for the particular business
• learning how to use them or more importantly how to configure and execute them tailored to the business environment
• generating concise and easy to use results reports that identifies the negative business impacts and reveals the steps needed to reproduce the detected vulnerability
• prioritizing the results based on the impact severity

 Advantages of manual pen-testing

One of the promising approaches that can be taken is to use a service containing:

• Manual pen-testing by ISO certified expert – they can use automated tools
• Defined and standardized scope for pen-tests based on industry standard security frameworks (e.g. OWASP)
• Tailoring the tests for the business environment via a discovery call
• Delivering pen-testing results report including the exact information about severity, priority and steps on how to reproduce detected vulnerabilities
• Committing a results report delivery date based on the scope selected
• Offering a review of the results after delivering the report
• Optionally, in case business requests it, re-testing the detected vulnerabilities after agreed period of time

What are your thoughts and comments on it? Let us know and you are most welcome to take a look at https://eudaitec.com/services/penetration-testing/

Have a great and secure week ahead, cu next time