Penetration Testing for Regulatory Compliance

While the shift from paper copies to digital storage has enabled organizations to increase efficiency in countless ways, bad actors have also launched countless attacks to steal private information. In order to protect this valuable data, many industries now have cybersecurity regulations. HIPAA has been expanded for healthcare and NERC applies to the utilities and energy sector, and higher education institutions must adhere to HEOA, to name a few. With so many new or expanded regulations—from SOX to the GDPR to the CMMC, cybersecurity teams have the added task of maintaining compliance, often with no new headcount to help with additional work.

For instance, many of these regulations either imply or specifically require pen testing as a way to evaluate an organization’s security posture and adherence. Requirement 11.3 of the Payment Card Industry Data Security Standard (PCI DSS), for example, states that a comprehensive pen testing program must be implemented.

It’s no surprise that, according to the 2020 Pen Testing Report, 67% of the cybersecurity professionals surveyed reported that compliance was the primary reason that they performed pen tests. Why is pen testing a key component of compliance initiatives, and what is the best strategy for meeting this requirement?

Why is Pen Testing So Crucial for Compliance?

By exploiting an organization’s infrastructure, pen testing can demonstrate exactly how an attacker could gain access to sensitive data. As attack strategies grow and evolve, periodic mandated testing makes certain that organizations can stay one step ahead by uncovering and fixing security weaknesses before they can be exploited. Additionally, for auditors, these tests can also verify that other mandated security measures are in place or working properly.

Meeting Basic Compliance Needs with Pen Testing Tools

Many falsely assume that in order to meet compliance needs, third-party testing is required. However, this typically is not the case. In fact, PCI DSS, which has some of the most explicit requirements for pen testing, doesn’t state that a third-party test is necessary.

Some organizations find that many aspects of compliance testing are straightforward and even repetitive. A pen testing tool like Core Impact provides an easy to follow and established automated framework that can support these types of tests as it doesn’t require extensive pen testing experience.

For example, one of the external tests listed in PCI DSS Requirement 11.3 are web application layer pen tests, which are needed to identify weaknesses like SQL injection or cross-site scripting (XSS). Core Impact’s automated One-Step WebApps Vulnerability Test identifies these weaknesses, as well as others like broken authentication, broken access control, and security misconfigurations. Additionally, Core Impact’s intuitive wizards and automation capabilities help testers gather information, execute attacks, escalate privileges, and more.

Some organizations find third-party services ideal for determining compliance needs and obtaining strategic support with initial tests. They then use pen testing tools to maintain compliance. For example, PCI DSS states that any vulnerabilities identified during testing must be fixed, and that a follow-up test is required to verify that they have been resolved. A third-party may conduct the initial testing, and then a security team member could deploy an automated test to validate these remediation efforts.

Finding the Right Third Party for Complex Testing

By using an automated tool for basic compliance tests, a third-party service can be utilized for more complex needs. For instance, PCI DSS and most other regulations require testing to take place after a major change to the operation environment. This may involve a test with multiple attack chains or other sophisticated tests to ensure that such changes didn’t cause new security weaknesses.

However, this requires an organization to be more discerning of the third-party they choose. Many firms focus on running simple tests with a wide scope—all of which can be handled by a security team using a tool like Core Impact. It’s important to find a service with experts that tailor their tests for your needs and goals so you can get the most value out of a third-party service.

The Future of Pen Testing and Compliance

As time goes on, it is likely that more regulations will be put into place—the GDPR, CCPA, and the CMMC have all been enacted in the last three years. With so many requirements to meet, it’s easy to start to see compliance as boxes to be checked. But by using your resources wisely—streamlining the routine with automation, and using expert services for more unique, complex issues—you can use compliance initiatives as an opportunity to advance your security posture to the next level.