As we've mentioned before, it is becoming increasingly difficult for organizations to purchase or renew cyber liability insurance. Part of that difficulty comes from new or increasingly strict requirements around cybersecurity measures. Part of these requirements include penetration testing and vulnerability scans, but what are they? We'll provide an overview of each, how they differ, and how they can help you remain secure.
How are Penetration Testing and Vulnerability Scans Different?
Both penetration tests and vulnerability scans can help you find weaknesses in your organization's cybersecurity efforts, but they are not the same thing. A vulnerability scan will check for known exposures and help you build a report that will aid in mitigating your risks. A penetration test will try to exploit gaps in your security environment.
Vulnerability Scans
Vulnerability scans are typically automated scans of your network devices to show possible susceptibilities. This includes checking your firewalls, routers, switches, and servers. These scans will only identify known vulnerabilities; they won't do anything with that information except generate a report. These scans can be run more frequently in your environment to confirm your risk level remains appropriate for your business.
Penetration Tests
Penetration testing can involve a larger or smaller section of your network. You can use this to ensure that specific applications are safe or to run a test on your entire infrastructure. They will not only show that something can be exploited as a weak point, but will exploit that weakness and show how an attacker could gain access to your systems. These tests are always manually run by security professionals.
What Happens with the Results?
Regardless of which option you choose (or if you complete both) they are useless until you do something with the results. The results should be reviewed by your senior leadership, those impacted by the test, and your IT/security team. You should use these results to create a plan to make improvements, including the findings, severity level, remediation steps, task owner, and completion deadline. Someone should be assigned to lead this project, and the goals should be clear to non-technical team members.
These security measures are not one-time exercises. It is up to your organization to determine the level and frequency of security testing to make sure you are within your risk comfort levels. If you have questions about cybersecurity, want to assess your current environment, or need general IT support please contact us.
Leave a Reply