- hello@group8.co
- 12 Marina View, Singapore
An organisation’s cybersecurity will always be an ongoing effort, given that the status quo only lasts until the next major malware outbreak or data breach hack makes the news. Penetration testing remains the key to the need for continuous and deliberate evolution of a business’s cybersecurity protocols. It is a coordinated and periodic approach to testing defences to seek and patch vulnerabilities. Despite coming off as complex, preparing for pen tests is neither time-consuming nor difficult to do. By knowing what to expect and preparing, pen testing can be as frictionless as possible for everyone involved. Below are a few tips on how to be ready for what’s to come in an upcoming pen test in Singapore.
Below are a few tips on how to be ready for what’s to come in an upcoming pen test in Singapore.
A full understanding of the environment being tested ensures testers have all the clearance they need to do their job. Organisations should also consider if testing at a lower-level environment and not in production makes more sense. Simultaneously, it is essential to avoid incorrectly scoping the pen test engagement as, more often than not, pen tests will be more like vulnerability scans out of concern for the reliability or availability of production systems. Limiting a pen test's scope or vectors of attack to carve out vulnerable or critical systems is a disservice to the organisation.
Planning for a penetration test requires that you provide technical points of contact to the pen test team before, during, and after the process is an essential part of preparation. Take note of the personnel with such responsibilities and assign those on call as internal points throughout the testing. Next is to inform the relevant parties about the upcoming pen test, specifically the key IT personnel that need to be kept in the loop.
If IT teams are kept in the dark about a penetration test, they may take it as a real threat, sound the alarm, deploy incident response procedures, and overall make things more difficult. In addition, if an unannounced test causes issues, the right people may be unavailable to deploy fixes. This is all worth considering despite being the absolute worst-case scenario.
It is not uncommon for organisations to have low time commitment before or during the penetration test. However, that should not be the case after the test has concluded, as it is perhaps the most critical commitment on their end. The amount of time necessary will largely depend on the pen test findings and recommended remediation level.
Planning ahead allows one to allocate enough time and resources to resolve any issues detected during the process. The organisation will need to summarise all the risks or issues listed in the report for upper management and present a feasible time frame for deploying the required fixes. Although it takes time to prioritise the recommendations with an eye to procedures, threat level, and resources, the net result of heightened cybersecurity and better security awareness is worth every second.
Pen testing is generally production safe and should not create availability issues. Despite that, there is no guarantee that glitches will not affect the network or application side, as pen testing can potentially exacerbate existing issues within them. As such, it is best to have staff available and ready to collaborate with testers should issues arise so that they can be addressed and resolved as soon as possible.
Many organisations often step up their security prior to the beginning of a pen test. This is not a sustainable approach, as security consultants require the most accurate representation of the environment for their test to be effective, not one that has been superficially spruced up just a few days before. Nonetheless, there are commonly identified issues one can tackle that can save pen testers time, such as:
● Fixing missing patches
Security patches must be installed as soon as they go live to prevent bad actors from exploiting them and compromising systems.
● Ensuring strong passwords for all accounts
This prevents the embarrassment of having the pen testers detect weak passwords or use default passwords.
● Validating web app input/output
Insufficient validation of the input from clients or the environment is among the most common weaknesses in web application security. As a rule of thumb, never trust client data, as there are numerous ways to tamper with it.
● Restricting admin interfaces
Establish access control lists and limit connectivity for high-value targets such as FTP services, SSH services, private APIs, video conferencing logins, remote control interfaces, and more.
Before the start of any testing procedure, it is also recommended to ensure a tested and up-to-date backup of critical data and key systems. Keep these recent backups accessible instead of offsite storage, as this precaution saves precious time should a situation arise that needs this backup media.
If your organisation needs the most comprehensive penetration testing, GROUP8 is here to help. Our CREST-certified penetration testing services in Singapore ensure no exploitable vulnerability goes undiscovered to ensure your security leaves no gaps for attackers to use. Apart from pen testing, our offensive-inspired cyber defence ecosystem also includes many other solutions that further strengthen your security, such as data loss prevention, threat intelligence, vulnerability research, digital forensics, and more. Reach out to us at hello@group8.co to learn more about our full services and other details.