{"id":11641,"date":"2022-11-10T09:19:05","date_gmt":"2022-11-10T09:19:05","guid":{"rendered":"https:\/\/ee.yelkdev.site\/?p=11641"},"modified":"2024-12-09T14:45:09","modified_gmt":"2024-12-09T14:45:09","slug":"are-penetration-tests-all-you-need-to-ensure-your-cyber-security","status":"publish","type":"post","link":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/are-penetration-tests-all-you-need-to-ensure-your-cyber-security\/","title":{"rendered":"Are penetration tests all you need to ensure your cyber security?"},"content":{"rendered":"

Of course they aren\u2019t!<\/p>\n

But despite the continued parade of major information security breaches by companies large and small, this title (Betteridge\u2019s law<\/a> anyone?!) is justified by the amount of organisations that still rely upon penetration tests as their only line of defence against security vulnerabilities. This isn’t a good idea.<\/p>\n

The problem with relying on penetration tests<\/h2>\n

Relying on penetration tests as your sole cyber-security control is like assessing the health of the Titanic using a photo taken from the iceberg.<\/p>\n

A penetration test is unable to give you any indication of what’s coming in the future because it’s static, point-in-time, and outside-in (just like that photo!). It has a limited value in understanding health.<\/p>\n

Penetration tests also have costs. Both the direct costs of paying for them (most organisations seem to use third-parties for this) but maybe more significantly – because they almost always act as approval gates – they can actually block value from being regularly, and frequently, delivered to your customers.<\/p>\n

This isn\u2019t to say that penetration tests have zero-value, they are a useful tool as part of a wider set of security controls – but their use should be determined through deliberate security risk assessment and threat modelling.<\/p>\n

What we recommend instead<\/h2>\n

Continuous Security<\/strong><\/p>\n

The primary recommendation is to operate a system of continuous security as described in our Secure Delivery Playbook<\/a> (published under a Creative Commons licence!)<\/p>\n

However – we understand that simply telling you where you should be, isn\u2019t always helpful. We also like to help our clients understand where they currently are.<\/p>\n

If you feel you have a Security Blind Spot – i.e. products, already in use, that you think may have been delivered without active engagement from an infosec team, and you lack\u00a0 confidence that they have sufficient security controls in place – then there is another approach that we can share.<\/p>\n

Security Health Check<\/strong><\/p>\n

The objective of a security health check is, in a very objective way (sympathetic to the culture of a \u201cblameless post-mortem\u201d), to ensure that the team, the stakeholders, and the organisation are aligned in their understanding of the current state of security controls around a system\/product.<\/p>\n

This involves:<\/p>\n