Read more about the current Greenbook proposals. ...
This site uses cookies to ensure that we give you the best user experience. Cookies assist in navigation, analyzing traffic and in our marketing efforts as described in our Privacy Policy.
When organizations look to assess the resiliency of their information systems, there tends to be some confusion around what exactly vulnerability scanning and penetration testing each provide. The truth is that both paint part of the larger picture necessary to spot the key gaps in existing controls. Schneider Downs recommends that organizations perform internal vulnerability scanning at least monthly and external penetration testing annually. When implementing these activities, organizations should understand the basics of each.
Continuous vulnerability management practices form one of the cornerstones of any cybersecurity strategy. Scanning tools provide valuable insight into the current health of network-attached devices, and can identify critical gaps in patch management and change control. Vulnerabilities can be prioritized, patches deployed, and device configurations updated. But there are some key areas that vulnerability scanners often miss.
Common issues with vulnerability scanners include:
While vulnerability scanning uses a set of predefined rules to identify gaps in software patching and system configuration, penetration testing relies on human analysis of systems and leverages many of the same tools that actual hackers use. Some examples of targets and attack techniques used in a high-quality penetration test:
Comprehensive penetration testing requires a diverse set of skills, and while organizations with large security teams may be able to dedicate staff to an internal red team (attackers) – a group focused on performing penetration tests – smaller organizations will primarily allocate security staff to their blue team (defenders), which focuses on maintaining technical security controls. For these smaller organizations, red team exercises are commonly outsourced to an expert firm. A growing practice is for organizations of all sizes to combine red and blue team efforts in regular purple team exercises, which allow the defenders to see attack techniques used in real time and actively tune security controls for prevention, detection and response.
The Schneider Downs cybersecurity practice consists of experts in multiple technical domains. The team’s mix of skills and experiences in real-world cyberattack scenarios enables us to provide your organization with a comprehensive look at external vulnerabilities ranging from susceptibility to social engineering to critical weaknesses in external web applications. Our whitepaper outlining the advantages of external penetration testing is available at www.schneiderdowns.com/maximize-value-penetration-testing.
Read more about the current Greenbook proposals. ...
Learn more about the regional and national supply chain implications of the Baltimore Key Bridge collapse. ...
We’d love to hear from you. Drop us a note, and we’ll respond to you as quickly as possible.
Ask us
[email protected]
p:412.261.3644
f:412.261.4876
[email protected]
p:614.621.4060
f:614.621.4062
[email protected]
p:571.380.9003