Two cybersecurity professionals outline three pen testing approaches: compliance-driven tests, broader discovery tests to find unknown assets and misconfigurations, and continuous application-focused testing. They argue that assessing actual cloud and Active Directory configurations often yields more value than traditional tests, and that configuration drift like an open firewall rule creates hidden risk.
Well, there's a lot of different pen tests out there, and the short of it is, at the end of the day, what do you want to pen test?
It can be pretty expensive if you come in and say, "Let's test everything." And I would put it at probably 3 different tiers if we really break it down.
You're going to have those companies that they don't have a giant footprint, they have a compliance requirement to do a pen test, whether it's for legal reasons, contractual reasons, insurance reasons.
In some of those cases, you may want to keep that scope small and not overspend, and I have a reason to that, and we'll come back to it. You have the next tier of going, I don't know what I don't have. I have had challenges in the past. I may not have a great inventory. I want you— and we've made some reasonable efforts to secure our environment. Go see what I'm missing or what I didn't get to. Both of those cases we can handle here at Reveal Risk. We've done a bunch of those, and we have different tools and techniques we can bring to the table. Sometimes we'll do that in-house. In other cases, we'll lean on external partners to come in. Because that gets to the next tier is you may have complex applications, you may have unique tools, you're like, no, I need to make sure this thing is really robust. I want somebody in there testing real time, looking at this thing on a regular basis. My development cycle is fast. Find those holes, find those problems, make sure we didn't introduce something new that we didn't know was there a month ago. Those are probably not for everybody. You know, the Netflix of the world, they're doing that stuff. All the time, and they probably have 2, 3, 4 levels of penetration testing, and they've got a unique model on how they've done that. It's those other 2s that I think we're much better at. Compliance one's fine, we can do that. They're less fun for anybody. It's go get it done, give me the report, make sure we don't have anything out there. The ones we can come in and say, what are you trying to secure? What maybe have you not spent a decent amount of effort, or you have concerns around, or you've had problems in the past? 'Cause we can secure an environment, or many times people try, but it drifts. Things get reconfigured.
You put in support tickets. You make changes. I remember one. Everybody's firewalls were protected. They were not accessible from the internet. People were very rigid about that. There was a ticket in with their support team, and somebody opened it up temporarily for their vendor to come in and do support, and they just forgot about it. They went home on a Friday and forgot about it, and 2 months later, it pops up, and that was not anything anybody intended to do. Those types of things can be caught. And then we have the traditional ones. Can we break into Active Directory? Can we break into your email system? Those are all fine and good, and sometimes those are helpful, but the part where I suggested do those compliance checks and keep them small, because the adjacent services are the things that we offer to do, which are much more fun, and I find more valuable for organization, is let's come in and actually assess how you've configured and secured your environment. That's the, let me get inside your house instead of sitting outside the window or behind the couch and just trying to look around from a distance and see what I can see.
Let me come in, look how you've actually set it up.
That's where we can walk into your Office tenant, your Azure tenant, or your IT infrastructure, look from behind the scenes and actually see how did you secure it today versus yesterday. Have you patched it recently? Have you left services open? Did you turn the dials on the right way? And all of those change because people are putting in support tickets, they're making changes. Those I find are more valuable and more helpful because most organizations don't have all those support teams sitting around paying attention to how it's configured. They're just trying to make it work. They're trying to fix the problems that come in and move their users forward. They don't always have the time to stop and say, hey, the last 6 months, did we configure this the right way, or Honestly, I have seen vendors deploy patches and they undo the good work that you've done and you have no idea. In the worst-case scenarios, sometimes hackers get in, they make a bunch of changes, nobody notices, and they just leave them there and you don't know. So more valuable than just pen testing alone is that configuration assessment to say, how did I configure my cloud tenant? How did I configure my email system? Do I have the right protections turned on or did I forget about them or did somebody turn them off accidentally? That can be more valuable because you can get a very prescriptive list of these are the 5 to 10 things that we need to do, and you're not doing it from sitting outside in a window looking in. You're, you're in there with support looking at the right things at the right time.
