This article was originally published on Enterprise Management 360 on March 31, 2020.
Penetration testing is the Marmite of cybersecurity: you either love it or you hate it. Taking a neutral stance on the matter, it’s easy to see both sides. On one hand, pen testing provides indisputable evidence of vulnerabilities for organisations to action. Pen testers are also often able to identify even the smallest of vulnerabilities that hackers would exploit (and businesses would usually miss).
However, on the other hand, pen testing can be an expensive endeavour, and can cause serious damage if not done correctly. Furthermore, pen testing also requires that you trust the testers, which is a calculated risk organisations simply must take.
Despite the disadvantages, pen testing is a keeper for its highly proactive approach to cybersecurity – it just needs bolstering in some way. Fortunately, automation provides the means to do exactly that.
Enterprise technology has called upon automation as a solution to numerous enterprise challenges. Famously, automation can eliminate or minimise risk of human error, as well as speed up process times, making it the natural answer to many problems. Cybersecurity is no exception to this, as technologies such as robotic process automation and SOAR continue to take centre-stage.
Why should pen testing be automated?
To better demonstrate how pen testing can benefit from automation, we will use one of our favorite offerings: beSECURE (now part of Fortra Vulnerability Management). beSECURE remedies the drawbacks that manual pen testing often presents. For example, it eliminates the issues found with frequency; pen tests are periodic, and new security situations can present themselves between intervals in just a matter of days. In other words, new vulnerabilities can sit on the network without consideration until the next test.
Organisations can use beSECURE in combination with vulnerability assessment management on a monthly, weekly, or even daily basis, making it perfect for frequently changing services (web applications, etc). In turn, you can quickly detect and test new hosts and identify weaknesses introduced by changes to the host at speed.
As mentioned previously, automation minimises the potential for human error. Such is the case with beSECURE, which hones in on ease-of-use so any competent network admin can run it. What’s more, with beSECURE, speed is everything. It delivers to-the-point reports, that encourage compliance in turn, and can scan entire networks quickly.
Finally, beSECURE will not burn a hole in your pocket. Instead, you can purchase a typical beSECURE installation for the cost of one comprehensive pen test.