How to Choose a Penetration Testing Vendor Wisely?
Pen-test or penetration testing is a security process where a skilled cyber-security professional endeavor to locate and exploit vulnerabilities in a computer system. The sole intention of this simulated attack is to recognize any feeble spots in a system defense which the attackers could take benefit of.
This is something similar to a bank that hires someone to dress as an intruder and try to rupture into their building and get access to their vault. If the intruder succeeds and gets access to the vault or the bank, the bank will receive valuable data on what needs to be done to stiffen their security measures.
Just like financial audits, a security audit is also generally advisable to be done by a third-party vendor as they would perform the tests with no bias to anything or anyone in your organization. Secondly hiring a security testing company rather than appointing an in-house team to conduct the penetration test is preferred as it is difficult to employ and retain penetration testers.
Following are the top considerations before selecting a penetration testing vendor:-
1.Crystal Clear View in the testing process
Most penetrating testing vendors do not give clear visibility in the pen-test engagement. Internal stakeholders are rarely involved in the crucial vulnerabilities in the system. Choose a vendor who can give you a crystal clear picture of what is happening across the testing process. Once you are involved in the kick-off, retesting and remediation phases, you can immediately respond to the reports. This helps to minimize the remediation time and thus reduces the overall costs.
2.Emphasize knowledge and not just certifications
Ideally, the penetration industry has not arrived at a consensus of a significant certification framework. Hence while selecting vendors, do not concentrate much on individual certification, otherwise, you will land up eliminating many top-notch penetration testers. Give more weight to the individual skills of the pen-testers rather than industry certifications.
3.Assimilation in your Software Development Life Cycle
Many pen-testers usually focus on the final outcome which is the PDF delivery. The report is vital, but it is terribly long and does not shed light upon the remediation priorities. In order to allocate the findings to the right developer, it is important for the penetration testing platforms to integrate flawlessly with the Software development life cycle. This will fasten the fixing process.
4.Assess the vendor’s dependability and trustworthiness
As the selected vendors would have access to all your sensitive data, customer information, company research, and many other confidential matters make sure the vendor is reliable and trustworthy. Check their reputation and reviews from previous clients before finalizing them. Bombard them with the below questions and judge their competency level based on their responses.
- Ask them about their liability and indemnity clauses
- Ask them to explain their hiring process
- Ask them how is data stored in their organization?
- Enquire about their insurance processes.
5.Skilled and Interactive Pen testers
Generally, security firms assign around 1–3 researchers for a penetration test. These are entry-level individuals who rarely interact with their customers. Select vendors who employ skilled professionals that work in collaboration with their customers and keep them updated with every move in the testing process.
6.Delivery Pace
Timely completion of the pen- test is another important aspect that needs to be considered while selecting a vendor. Based on the number of tests that you plan to execute, analyze how fast you want them to be done. The pace of delivery varies across different vendors. Some vendors commence anywhere from 24 hours to a few days while some need a queue time of around 4–6 weeks. Some vendors even charge extra to accelerate timelines.
7. Plan Long-Term Security Goal
Before selecting a Pen-test vendor, one must deem about their long-term security goals. Analyze at what frequency do you need to execute the pen-tests? Which compliance initiatives do you wish to fulfill? A better strategy would be to integrate pen-testing as part of a long-term security goal rather than just executing the pen-test for just fulfilling certain compliance initiatives.
Originally published at https://wesecureapp.com on March 16, 2021.
