Security experts: Penetration testing is not a one-time process

If you search "How often should I do a penetration test?", the first answer that pops up is "once a year". In fact, even industry-leading standards like PCI-DSS require an external penetration test annually (or after any significant change to infrastructure or applications), while internal penetration tests are conducted annually and segmentation tests every six months.

However, today's cybercriminals do not work on an annual schedule. They don't wait for penetration testing time to come around or for vulnerabilities to be remediated. They strike swiftly, using advanced AI-driven and automated tools to exploit vulnerabilities that many organisations don't even know exist. Gartner calls these threats "high-momentum threats" and advises at-risk organisations to adopt a more streamlined approach to cybersecurity. Addressing the challenge of agile cybercriminals requires a more agile approach that compensates for the shortcomings of penetration testing.

▌Faster Cycles

Today's standards are catching up with the pace of cybercrime. According to the NIST Cybersecurity Framework (CSF), organisations should verify that they have patched vulnerabilities after each system update or patch deployment. However, this is difficult to do in practice. Simple economics: traditional penetration testing is highly resource-intensive and therefore expensive. Skilled penetration testers are in high demand, so service fees are high. A single penetration test for a portion of a target IT environment can easily cost hundreds of thousands of dollars. Few organisations have this type of budget — and certainly not the type of budget required to scale penetration testing across the entire environment at the frequency needed to ensure the network remains secure as new systems, users, and applications are updated or added.

▌The Need for Automation

The traditional attitude towards manual penetration testing is a bit like the traditional approach to driving navigation: nothing can replace human maturity and accumulated knowledge. Taxi drivers will always beat GPS, and highly trained penetration testing professionals will discover vulnerabilities and attacks that automated tests might miss, or identify responses that seem legitimate to automated software but are actually threats. There may be some truth in this, but with off-the-shelf tools and services like RaaS (Ransomware-as-a-Service) or MaaS (Malware-as-a-Service) using AI/ML capabilities to increase attack efficiency, organisations need an army of penetration testers to truly meet the challenge of today's cyber threats. Once you find, train, and employ them — cyber attackers will only increase their automated efforts, and at that point, the organisation needs to recruit another army. Clearly, this is not a sustainable cybersecurity model. Similarly, the widespread adoption of agile development methodologies has translated into increasingly frequent software releases. Because environments are constantly evolving, the results of penetration tests performed on older or pre-release versions quickly become obsolete. Agile often relies on open-source and other off-the-shelf code snippets, which are highly susceptible to vulnerabilities. For all these reasons, organisations adopting penetration testing are increasingly turning to automation to achieve continuous security validation.

▌Continuity

Traditional penetration testing methods (both manual and automated) provide a snapshot of a network or application's security posture. However, as mentioned above, environments are highly dynamic, causing the attack surface to constantly change. When a new API is connected, a new server is added, or a new release is launched, but the next round of penetration testing is still a year away, that snapshot is no longer valid. To address this, organisations are turning to continuous penetration testing models. Rather than testing only once a year, these organisations are adopting tools and methodologies that can continuously test their environments. As attackers continuously target organisations to discover and exploit new vulnerabilities, there is no choice but to adopt a more proactive approach to discovering and remediating vulnerabilities. Traditional point-in-time security assessments simply cannot keep up.

▌The Bottom Line

Cyber threats have become more agile, more scalable, and infinitely dangerous. Traditional manual and periodic penetration testing simply cannot provide the security organisations need to survive. Only automated and continuous models can protect constantly changing networks and applications, helping businesses stay secure, compliant, and continuously profitable.

Based on the shortcomings of traditional penetration testing models and the endless stream of new cyber attack methods, SecurityAssure pioneeringly introduced the concept of using real, automated APT attack scenarios to continuously validate the effectiveness of security defences in China. This aims to help customers achieve 365-day continuous evaluation of their own network and data security defence systems using security validation technology. Compared to traditional automated penetration tools, the SecurityAssure Validation Platform can continuously provide security validation services for organisations, offering several advantages that traditional security tools lack:

• Acquiring various threat data from front-line intelligence, including real, active, and trending attack data, as well as various TTPs used by attack groups

• Able to measure the effectiveness of security protection measures against various trending and active attack behaviours

• Equipped with the ability to safely test and validate malicious files and ransomware, ensuring that customer assets remain unaffected during the validation process

• Able to automatically and continuously monitor changes in security protection capabilities within the enterprise environment

• Providing data support for enterprises to analyse the return on investment

• Helping enterprises optimise their security protection systems as well as SIEM and SOC strategies

• Supporting detection across different stages of the entire attack lifecycle

• Alerting to changes in the environment, reducing the workload of security operations personnel

| Reference source:

https://www.helpnetsecurity.com/2022/06/14/need-for-continuous-penetration-testing/