The business case for penetration testing
Aaron Taylor, Cyber Security Consultant & Tester.
If you’re reading this article I’m guessing that you’re either about to make the business case for penetration testing or you’ve had the case made to you and you’re doing your own research. Whichever it may be, you are in the right place. I’m going to help you put together a business case for pen testing your infrastructure in a way that is engaging, informative, commercially sound and maybe even fun. Let’s discuss the business case for penetration testing services.
Table of Contents
The Challenge of Buying Security
Security can be a strange thing to purchase. I think it has a lot of similarities to buying insurance in that there are a lot of security measures that you can buy, you do so in the hopes that you’ll not need to use it in anger.
No one wants to get home at the end of a day finding crowbar marks on their front door as evidence that a break-in attempt was thwarted. Yes, you might feel a great sense of relief and say “I’m glad I opted for the three-hook multipoint lock with the three-star BSI anti-snap cylinder” but you’d much rather that the would-be assailant didn’t try and break into your house in the first place.
And so it is with security purchases. If we lived in a society where there wasn’t a multi-billion dollar industry of trained professionals who are trying to steal your stuff, then we’d only need to protect against accidents, acts of God and the like.
But we don’t live in a crime-free society. Threat actors are trying to steal your things. So we have to spend vast amounts of money creating, maintaining and testing our security measures. And now that we live in a digital age, the information age, the majority of those security measures are invisible, for all intents and purposes.
The invisible nature of cybersecurity
You can’t tell if a firewall is working properly just by going to the server room and looking at it, or giving it a firm shake like you would a locked door. You can’t see the open ports on a web server just by walking outside your office and looking for open windows and doors. We need specialised tools and levels of access to get a literal view of our security measures.
When I used to work for a web design company, I was, unsurprisingly, the de-facto advocate of security. Any websites we built and hosted would be developed using secure coding practices, and deployed with things like web application firewalls, antivirus scans and various other security-minded things.
We would also sell security solutions to websites we didn’t develop where we were confident that we’d be able to deliver the same standard of service. Occasionally, someone would want to buy the hosting without the security or ask for a one-time fix for an issue that they had.
Continuous cyber attacks: The harsh reality
I confess that I took some measure of pleasure at seeing their expressions change when I delivered my favourite line: all websites are under attack, all of the time. Occasionally I would follow it up with a live view of the thwarted break-in attempts against our own website, as one or more botnets would try tens of thousands of username/password combinations as it tried to grow its flock.
This live demonstration wasn’t just for the dramatics, I wanted the person across the table to actually see what this ephemeral thing called ‘cybersecurity’ really looked like. I wanted them to say wow, I never knew it was like that. And I wanted them to start to see the value in the thing I was asking them to pay for.
Why? Because without some kind of tangible feedback, cybersecurity proves its worth in the counterfactual, the things that don’t happen. The proof that your cybersecurity is working is that you haven’t been robbed of your data, or that you’re not being held to ransom. And unlike the wreckage of a car that crashed into a bollard of a would-be ram-raid attack, very few people actually see a thwarted cyber attack.
The counterfactual nature of cybersecurity
So when you take the counterfactual nature of effective cybersecurity and combine it with the fact that most businesses have already invested considerable sums of money into their cybersecurity, making the business case for buying penetration testing might seem like an uphill struggle. “Wait, you want to buy even more cybersecurity on top of the cybersecurity we’ve already got?” isn’t an unreasonable question to the proposition.
But, as mentioned earlier, you’re in the right place and now we’re all on the same page, let’s start with a definition of what penetration testing is. We’ll then discuss why pen testing is important for all industries.
What is penetration testing?
Penetration testing is a type of security test where a security consultant, or pen tester, attempts to identify and exploit vulnerabilities in a computer system in the same way and using the same techniques, tactics and procedures that a malicious actor would. Now whilst that’s nice and accurate enough for a dictionary definition, it wouldn’t make it into any advertising campaigns.
Pen testing is like hiring a professional criminal to put your security to the test, but instead of stealing things they write you a report to tell you how they got in. Penetration testing is one of the best ways of answering that nagging question of how robust your security actually is. It combines the automated coverage of something like vulnerability scanning and adds to it the curiosity and creative problem-solving skills of an ethical hacker.
With penetration testing, you’re not only able to see what vulnerabilities exist within your systems, but you’ll learn how they can be chained together to grant even greater access to a computer system.
This idea of chaining vulnerabilities together can’t be overstated enough, because it’s exactly this type of chaining of vulnerabilities that vulnerability scanning alone can’t show you. It takes a creative, human mind to spot these types of opportunities. As a practising pen tester, I can tell you there’s no greater joy in this job than chaining together multiple low-and-medium severity vulnerabilities on your way to fully compromising a system.
Pen testing generally comes in three flavours, depending on how you want your system to be tested. The flavour of the pen test that you get depends on how much information you disclose to the tester. Here’s a brief rundown of the three types, but to learn more in-depth about each, visit: the difference in white box, grey box and black box pen testing article, or watch the video below.
White box testing: You give the tester a large amount of information about the system to be tested from both a practical and a theoretical standpoint. It’s the most thorough version of a pen test but takes significantly more time.
Grey box testing: The tester is given some knowledge of the system’s internal structure but not as much information as in a white box test.
Black box testing: The penetration tester is given no prior knowledge of the target environment. They are tasked with discovering and exploiting vulnerabilities from a completely outside perspective, simulating an external attack as an uninformed attacker.
With some good, concrete definitions of pen testing in your back pocket, we can begin to craft a business case for adding pen testing into your security mix.
Penetration testing helps you find and fix your vulnerabilities. Fast.
It’s an inescapable fact of life – probably of the universe – that you can never truly know if something works until you test it. Even if the ‘test’ is only two sharp tugs on the ratchet strap and declaring that ain’t going anywhere, sooner or later we have to find out if the boat floats and that means putting it in water.
But isn’t it better to find those kinds of weaknesses in the comfort of a dry dock? If that’s even what dry docks are used for? Let’s pretend they are.
Penetration testing actually subjects your systems to the types of attacks that the bad guys use–that’s one of the hallmarks and the biggest benefits of it. You get a criminal-eye view of your security systems and a two-way dialogue with your friendly neighbourhood hacker.
Vulnerabilities that we find are categorised as either informational, low, medium, high and critical, and these are the categories that appear in the report along with a score from 0-10. Informational vulnerabilities are “Hey, you have a door”, lows are “This door has some theoretical issues”, mediums are like “I could maybe pick the lock”, highs are “Hey I jimmied it open” and critical vulnerabilities tend to be like “so I’m in the vault with the gold and also that door was open”.
The standard policy with pen testing is that we’ll disclose any high and critical severity vulnerabilities during the testing window which gives you the opportunity to fix those things there and then.
However…
Not all vulnerabilities are easily fixed.
The critical vulnerability might be the result of several medium vulnerabilities chained together–this is a key thing that differentiates pen testing from vulnerability scanning–and might require wide-ranging changes to the system.
The importance of chaining vulnerabilities together can’t be overstated. I’ve seen tests where a tester was able to access the client’s internal CCTV cameras–across the internet–by chaining together several vulnerabilities they found in their external infrastructure.
I myself once managed to chain together some vulnerabilities on a web application to achieve remote code execution (RCE) on the application server. Having this kind of insight into your networks and applications is priceless.
Pen testing helps you test your security measures
Maybe you’ve just finished setting up your brand new F5 BIG-IP Advanced Firewall Manager and you want to put it through its paces. Or maybe you’ve revised your Group Policy Objects as a part of your plans to implement a zero trust architecture and you’re wondering if there’s anything that can be abused. Maybe you’ve recently migrated to the cloud and need a thorough view of how well your security measures were implemented.
There are an infinite number of reasons why you might want to test your security measures and pen testing is most probably the most direct and in-depth way of actively testing them in as detailed and granular fashion as you need.
One of the things that I never knew about pen testing until I became one, was just how incredibly detailed and flexible the scope of a pen test can be. In most cases, the tests that I’m on are broad-based, with no specific areas that need extra attention. But a lot of tests that I do include things like “We want to know how easy it would be to escape the virtual machine” or “We’re particularly interested to see if you’re able to elevate your privileges as a self-registered user”.
These specific requirements might be the whole scope of the test, but more often they’re additions to a regular, full-spectrum test. In terms of making a business case for penetration testing, knowing that there’s this ability to be very granular and very specific with your requirements might appeal to the more budget-conscious as it means that individual concerns can be tested without needing to over-commit in your budget.
Pen testing can help you become compliant
If you’re already accredited and compliant, then congratulations for making it this far through the article but you might want to skip over this section.
There are many regulations and frameworks in the UK that either explicitly require you to perform regular penetration testing as a part of your activities or have requirements that are satisfied by regular pen testing. And quite rightly so, especially given the number of businesses that work in sectors like healthcare and finance, where they might be processing and storing vast amounts of sensitive and personally identifiable data. The sort of data that cybercriminals would love to get their hands on or, in the case of finance, the sort of money that they’d love to get their hands on.
Many of these types of businesses are likely also in the process of accreditation, or deciding whether accreditation is the right thing for them which makes the business case for penetration testing an easy proposition.
If you’d like to become PCI-DSS compliant, for example, it requires pen tests to be performed twice a year on your external and internal infrastructure. Outside of explicitly requiring pen testing, other accreditations massively benefit from regular pen testing.
GDPR requires that there be appropriate technical measures to ensure data security, and ISO 27001 requires security risks to information to be identified and assessed, as well as security systems to be tested. In all of these cases, regular pen testing can be a proactive means of assessing, managing and mitigating the risks and vulnerabilities to the information that your organisation holds.
Pen testing can help you see your Swiss cheese (Model of Risk)
Hear me out. Imagine a wheel of Swiss cheese. Now cut that cheese into slices, but don’t eat any of them as we need them for this demonstration. Lots of holes aren’t there? Now slide the slices of cheese back and forth and see if you can get the holes on each slice to align until you can see straight through the whole wheel.
You might have guessed it, but the slices aren’t just slices of imaginary cheese, they’re the security barriers and safeguards that you put in place to prevent failures of some kind. And those holes aren’t just holes in your cheese, they’re weaknesses and vulnerabilities in those barriers. When the holes line up, that represents some kind of risk, event or hazard that is able to bypass all of the measures that you put in place, and that is generally agreed to result in a Bad Thing happening to your organisation.
Now from a physical security perspective, you might have controls like a security fence with a gate, some doors which need swipe cards to access, lifts which only go to certain floors and a PIN code lock on the server room door. These all seem like reasonable security measures until an attacker tailgates someone through the security gate, steals a swipe card from reception, and shoulder surfs the pin number for the server room. That’s the equivalent of all of the holes aligning and a Bad Thing happening.
Pen testers are, by our very nature, interested in the methods and thinking of criminals. We love nothing more than figuring out how security systems can be bypassed and abused. And in that sense, we’re always moving those slices of cheese back and forth to find out where even the tiniest holes align. But, as pen testers, we’re also quite adept at flipping slices upside down, eating the slices or seeing if we even need to go through all that cheese in the first place.
Learn more about the penetration testing lifecycle here.
Pen testing is hard to do in-house
There is most definitely such a thing as knowing too much about a subject. Phrases like “can’t see the wood for the trees” are truisms for anyone working in large, complex environments.
In IT, we seem to be extremely adept at creating structures and systems that quickly surpass a lone individual’s ability to comprehend in its entirety. I’ve been on tests where I’ve asked about the nature of entire network segments or pieces of functionality and give a response to the effect of “hmmm, well that shouldn’t be there”.
When you know and understand a system intimately, you run the risk of thinking about that system in ways that lack novelty or are too conventional. Yet it is exactly a novelty that cybercriminals use to gain unauthorised access to computer systems. It is one thing to ask a systems administrator or a developer to create something using secure coding principles, and quite another to ask them to revisit and find the vulnerabilities in their work. This kind of approach needs a…
Fresh perspective
As I’ve said, pen testing and pen testers bring a novel, fresh approach to assessing the security of your systems, and that’s generally unencumbered by any ways of thinking that might be prevalent in your organisation.
It also brings a curiosity about systems that is hard to encourage if someone is working with that system day in, day out. Personally, I’ve found huge information leaks on pre-production web applications just by poking around at APIs and doing the equivalent of asking them stupid questions. These things are easily overlooked, especially when systems get to a certain size, even with the best secure development practices you can find.
Having an external, no-assumptions view of your networks and applications can find these kinds of mistakes quickly and cost-effectively.
Conclusion on the business case for penetration testing
Pen testing is a security measure and yes, it does come with an associated cost (read our article on penetration testing costs), however, in my opinion, it’s one of the most flexible, in-depth and practical security practices that you can employ in your organisation.
There are few better ways of getting accurate snapshots of the vulnerabilities and chains of risk that your organisation faces, as well as getting a criminal-eye view of how these vulnerabilities could be chained together to even greater effect.
As security experts, our goal is to make things safer, everywhere. I hope that with this article in hand, you’ll be able to put together a compelling business case for penetration testing in your organisation and–if you get the green light–maybe even give us a call!
