What’s the Magic Number?
The Optimal Frequency of Penetration Tests & Vulnerability Scans
This is the million dollar question of security professionals year after year: How often should one perform Pen Tests and Vuln Scans for their organization?
While there is no right or wrong answer, and each organization has its own unique security requirements, there does seem to be an industry standard: bi-annual (2) penetration tests and quarterly (4) vulnerability scans every twelve (12) months. Let’s explore each in more depth to figure out how often you should perform them for your organization.
Why Do I Even Need to Do These Again?
The simple answer: To keep your organization’s valuable assets safe.
The more technical answer: To consistently monitor and “poke” your organization’s attack surface in search of vulnerabilities. The goal is to proactively identify backdoor access into your environment, and patch known “holes” to prevent those with nefarious intentions from gaining access.
There is a wealth of increasingly sophisticated tools and techniques available to perform penetration tests and vulnerability scanning, and the bad guys are using these to scan the Internet looking for “low hanging fruit”. If you’re not doing the bare minimum to protect your organization, you’re leaving the proverbial backdoor wide open.
Other reasons why you should probably perform both:
- To identify the specific flaws and vulnerabilities that could lead to a breach and all of the expenses connected with those.
- To evaluate the efficacy of the security safeguards in place and plug any gaps that expose your organization to risk of breach
- Comply with regulations (e.g. PCI-DSS) for processes, team structure & IR plan to determine viability
- To maintain adequate security after any major infrastructure change
- Provide ongoing training and education to internal stakeholders
Remind Me What Each One Does Again?
Penetration Testing – A simulated cyberattack against your organization’s system to check for exploitable vulnerabilities
Vulnerability Scanning – The process of scanning your environment to identify security weaknesses, unpatched vulnerabilities, and flaws
Pen Testing = Simulating a real attack
Vuln Scanning = Identifying where someone could attack you
Is it Possible to Perform Them Too Much?
Because of the drop in price over the last years, it’s now very affordable to complete continuous vulnerability scanning. That means as often as your tool will allow, it is never discouraged to scan your environment for new known vulnerabilities. Typically, organizations complete VulnScans around four (4) times a year.
PenTesting too often, on the other hand, could actually be an excessive drain on time, money, and talent. While some elements and types of PenTesting can be automated, the process itself cannot be automated and still mainly relies on humans. Typically, organizations will complete a PenTest twice (2) a year.
The Value of Retesting
In order to confirm that remediation efforts were successful, retesting is vital! After your organization has scanned your network, completed a PenTest and performed remediation on found issues, it is crucial to perform the exact same tests as the prior to ensure the fixes were sufficient. Without putting these activities to the test, how can you be sure they worked? A weakness can continue to exist even if a user makes a small error (e.g. failing to restart the system after installing a patch). Retesting against the baseline of an initial test verifies that security flaws have been patched and enhancements have been effectively implemented.
In Conclusion
So, how often should you perform them? In the end, there isn’t a fixed, precise number. The size of your organization, the size at which you want to conduct your tests, and the kind of resources you’re willing to allocate matter. Simply said, the “correct” frequency is one that doesn’t keep you up at night. Talk to the experts at Idenhaus to get a better view of the whole cybersecurity picture. Want to read more about cybersecurity? Follow Idenhaus on LinkedIn or subscribe to our newsletter.
