Cloud Security Tip: Problems with Pen Testing

We talk a lot about penetration testing here, given that it remains a staple of proactive IT security. But not everyone feels it’s all it’s cracked up to be. Or should that be, all it’s hacked up to be?” More than one cybersecurity organization points out there are a few flaws in the pen testing concept that make it worth a second look.

Pen testing often consists of a small collection of attacks performed within a set time period against a small sample of situations. Some experts doubt the efficacy of testing against a limited field of known vulnerabilities, without knowing what other weaknesses exist in plain sight, or merely invisible to jaded eyes.

Since so much of data and network operations remains in a state of flux, what works to detect an anomaly one day might be completely lost at sea the next. Much depends on the ability and knowledge of the tester. Frameworks designed to offset these flaws can go quickly out of date. And who is doing the testing anyway? Are they prone to intentional or accidental sabotage of the very system they were hired to test? Is there a clear definition between actual penetration and simple breaking of stuff?

And as paradoxical as this sounds, sometimes there is greater liability in discovering a flaw than in letting sleeping dogs lie.

The weakness largely stems from the conscious decision to test, similar to doctors who diagnose a patient based on a pre-existing bias: “We were looking for evidence of cancer and we found none,” which does not eliminate a myriad of other causes of an illness, and in fact sometimes precludes them from detection.

Opinions about pen testing will always be divided, but I always like to go back to a fundamental analytical question: “what do we not know that we don’t know?”

This tip originally appeared here: https://cisoseries.com/who-are-the-perfect-targets-for-ransomware/