Unlike the financial analysis of a “normal” project or investment, it is tough to ultimately determine the return on investment of a penetration test. We like to relate a penetration test to your annual physical with your doctor. You go to your doctor to get a check-up as a preventative measure with the hope that […]
When going through one of our security gap analyses, we are often asked to clarify why the interviewee is being asked if they have an asset inventory in place. Asset inventories are more than just a spreadsheet to track your hardware. According to the HIPAA Security Rule Crosswalk to NIST, managing assets enables “the organization to […]
How do I fill out a vendor security assessment questionnaire? As company’s are beginning to become more security focused and realize that suppliers/vendors represent potential security threats, we are constantly being asked how to fill out a supplier assessment related to information security. While we think this is great for the security industry, it often […]
Is there such thing as an “approved” penetration testing company? This is something we get asked quite often. Unfortunately, there is no overall industry accreditation that is required for firms to be able to conduct penetration testing. There are, however, certain designations that firms can receive for certain types of audits that may require penetration […]
It’s hard to believe we are closing in on the end of 2018. We want to take this time to reflect with a look back at the 2018 cybersecurity year in review, and a look ahead to what next year may hold. Key Themes Continued Improvement, But Still Not Enough While firms are starting to […]
As you might imagine, penetration testing is an extremely technical field that leverages state of the art technology and concepts. With that in mind, it is not always easy to describe a penetration test, what penetration testing consists of, and what they can achieve to non-technical individuals. This includes members of senior management, board members, […]
Regular penetration tests, unfortunately, do not guarantee you won’t be hacked. In fact, if a firm offers you any sort of guarantee with regards to the results and your susceptibility to a breach following an assessment, this should be a red flag. While we can’t give you a penetration test guarantee that you won’t be […]
When working with a customer who hasn’t had regular penetration testing before, one of their primary concerns is usually “will a penetration test disrupt my business?” They may be required to get a penetration test completed in order to meet a compliance requirement, because a larger organization is asking them to, or simply because they […]
We get asked this almost as much as how often should we get a penetration test completed. There are many motivators and moving pieces that can drive the timing of a penetration test. Generally, if you’re asking “when should my company schedule a penetration test” the answer is “now”! Coming up with a regular schedule […]
We can file this away as a million dollar question for technology leaders and executives. While there is no right or wrong answer to this question, we recommend an annual security assessment that includes penetration testing. There are also actions that can be take throughout the rest of the year between assessments to help secure […]
