Wright Computer Solutions Information

Why Bother with Penetration Testing? At any given time,attackers are employing any number of automated tools and network attacks looking for ways to penetrate systems. Only a handful of those people will have access to 0-day exploits,most will be using well known (and hence preventable) attacks and exploits. Penetration testing provides IT management with a view of their network from a malicious point of view. The goal is that the penetration tester will find ways into the network so that they can be fixed before someone with less than honorable intentions discovers the same holes. If a CSO (or security team) has already pointed out to upper management the lack of security in the environment,penetration testing results help to justify the resources to address those needs. Often an internal network team will be aware of weaknesses in the security of their systems but will have trouble getting management to support the changes that would be necessary to secure the system. By having an outside group with a reputation for security expertise analyze a system,management will often respect that opinion more. Furthermore,an outside tester has no vested interest in their results. Inside a corporation of any size,there will be political struggles and resource constraints. If the CSO (or security team) are confident in their actions and final results, the penetration test report verifies that they are doing a good job. Having an outside entity verify the security of the system provides a view that is devoid of internal preferences. An outside entity can also measure the teams efficiency as security operators. The penetration test doesnt make the network more secure, but it does identify gaps between knowledge and implementation. Penetration testing gives security people a chance to recognize and respond to a network attack. For example, if the penetration tester successfully compromises a system without anyone knowing, this could be indicative of a failure to adequately train staff on proper security monitoring. Testing ...