It can be scary to get the results of a security penetration test report carried out on your business, but are the results all what they seem?

What is a penetration test?

A business should get a penetration test as part of a good practice process to test cyber security defences. Typically, a third party will be engaged to carry out these tests which are normally carried out at least once a year, usually taking several days to complete.

At the end of the testing, the penetration testing company will create a report of their findings and produce recommendations to address those findings.

The 4 stages of a penetration test

There are four steps to a penetration test:

1. The penetration test
2. The penetration test report
3. Deciphering the penetration test report
4. Remediating findings of the penetration report

The first two steps are simple and tend to be the only ones most people think about when carrying out a penetration test. However the final two steps are just as important, and take the longest time to carry out.

Deciphering the penetration test report

A penetration test report is typically very technical and will contain the identified technical vulnerabilities against the individual components of your IT estate. These vulnerabilities are typically ranked against the penetration tester's assessment of how critical these findings are, usually by how easy they are for an attacker to exploit and the impact they may have on the business. These vulnerabilities are then associated with a colour code of red, amber, or green indicators.

It is not unusual, therefore, that you could potentially receive a penetration test report that contains a variety of reds and ambers. Here are three reasons why you shouldn’t necessarily be concerned:

1. Context is key

What do these vulnerabilities affect? A penetration tester may not know what the underlying system in which a vulnerability they have identified is. This means that a vulnerability that is ranked red may be your most critical business application, but may also be your least business-impacting, most innocuous system or device that has no material impact should a vulnerability be exploited.

Key Takeaway: You should be clear on the systems and business context that findings are associated with.

2. Security absoluteness

What are the business risks & priorities? A penetration tester will report on the technical impacts of identified vulnerabilities, but technical risk is different to business risk. Businesses need to be pragmatic, so following security absoluteness is not always feasible, or practical, and can come with a high cost, therefore the business needs to assess and choose how they address that risk.

Key Takeaway: You should be clear on the associated business risk and the impact any findings would have.

3. Matter of opinion

No penetration test is the same. One penetration tester's red is another’s amber, and another one’s amber is someone’s red. Results of penetration tests can be subjective and penetration testing companies typically have their own methodology for scoring. Bringing in context and the business impact, alongside the technical implications of a vulnerability from the penetration tester, should allow for a better overview of what the remediation should look like.

Key Takeaway: Remediations should be based on all the information.

Remediating findings of the penetration report

After you have deciphered the penetration report, you then typically look to remediating the resulting findings. Remediations will come in different shapes and sizes depending on the vulnerabilities found, but will usually have one thing in common, they will be user-impacting.

Any technology change has some form of user impact, but security changes tend to have more user impact than most. It usually requires a change in the behaviour of how people use the IT in the business, and for little obvious benefit to the productivity of the end user, therefore making it a challenging sell. However, change is an important and necessary component of maintaining a good security posture as the security landscape changes.

You will probably need to prioritise and schedule any remediations of work and should try and do the following:

1. Address the highest risk items first (overall risk reduction)
2. Address remaining items by highest risk, least effort and least user impact (highest reward), making your way down

Depending on what the findings were in your vulnerability report, your remediations may take days or even weeks to resolve and will likely be the longest step in the overall penetration test journey. The involvement from people across the business is likely to be high, as you support testing the implemented changes.

Is a penetration test worth it, or is there a different type of test I should be doing?

Yes, a penetration test is not only worth it but is also a mandatory practice in regulated financial services firms. The nature of using third parties, who will not necessarily know the ins and outs of your business, means they can only realistically provide a complete outsider view of your security, and that view will differ from one penetration testing company to another. Whilst that external view of your security is valuable, it is only half the story. Firms should be prepared for the work that follows the initial results of the penetration test to ensure that the whole penetration test journey is completed.