How to Move Pen Testing Beyond Compliance

If you're on the right side of the law, yet you still believe that the solution to hackers is more hackers, then the concept of penetration testing is certainly something you've grown to appreciate - because in this case we're talking about ethical hackers, individuals who help organizations discover weaknesses across their databases, networks and applications before your enemies do.

The problem is that penetration tests are sometimes thought of as nothing more than an annual, set-it-and-forget-it exercise dictated by requirements such as the PCI Data Security Standard. But no IT or security professional who finds value in pen tests can say with a straight face - even if these intrusion simulations can't guarantee finding 100 percent of your vulnerabilities - that they should be relegated to a once-a-year activity. The way that your IT environment changes and the speed by which your adversaries evolve necessitates a more continuous and proactive approach.

Whether you're performing pen tests yourself or engaging with a security partner to do them for you because you lack the in-house capacity, you need to know what you're trying to achieve. And the answer may not be as simple as "assessing risk" and "making your systems more resilient to attack."

Trustwave SpiderLabs Practice Lead Will Harmon describes how to ramp up your pen tests and broaden their scope. As he explains, the process may begin with simple automated vulnerability scans that will lead you to bigger issues demanding a much deeper-dive investigation.