The importance of standardising methodology in penetration testing.(DATABASE AND NETWORK INTELLIGENCE)

They say people are a company's greatest asset but when it comes to penetration testing people are still the weakest link. When an organisation commissions a penetration test, should it be shocked to learn that the techniques used by many are failing to identify their vulnerabilities and are instead leaving them open to attack? This article proposes a different approach to penetration testing, one that focuses more on methodology than on software tools.

These days' business applications, and in particular web applications, have become vital information assets within many organisations, providing access to (and therefore exposing) key data to internal staff, external partners and the public at large. However, with an onslaught of attacks, organisations are now facing increasing complexities in balancing the need to deliver information services, and manage data securely.

Securing an application is a complex, yet necessary requirement for almost all businesses. The uniqueness of each application brings a challenge to ensure that the security requirements (functional and non-functional) are established, designed and implemented effectively. Only through a thorough penetration test can the associated security threats, such as exposure, theft or modification of sensitive data, regulatory or commercial impacts, brand damage etc. be identified; the risks quantified, and suggested actions provided.

When an organisation commissions a penetration test the expectation is that these security threats will be identified. In practice, however, many are not and organisations are being left exposed and at risk to attack.

For any organisation, having a false belief that they have an accurate stance on their security posture can be as damaging as having no idea at all. To blame the quality of the penetration testers would be easy, but it could be unfair. No matter how experienced or well meaning they are, if the process isn't well communicated and understood the results will be haphazard.

For this reason alone, a strong penetration testing methodology must be in place to ensure that the critical threats to the application, its data and the underlying infrastructure are mitigated to a sufficient level (risk driven), and also to identify lower impact, but important security issues.

A well defined methodology is paramount in any activity that requires repeatable results. With a methodology, the process of achieving a result can be studied and the results verified. Without one, accurate vulnerability identification, risk profiling and therefore assurance become very difficult. Methodology should be the foundation upon which assessment is built.