informa
Slideshow

7 Ways to Get the Most Out of a Penetration Test

You'll get the best results when you’re clear on what you want to accomplish from a pen test.
 Develop targeted goals for the engagement.
Ask for a report that's geared for the business team.
 Have the pen tester tell you what you're doing right.
 Solicit input from the developers.
Set up an annual pen test - at the least.
Ask for detailed reports for the tech staff.
Get the pen testers to go beyond the obvious.
1/7

Here's what you don't want from a pen test: A 600-page report packed with detail that overwhelms everyone in your organization.

Andrew Hay, chief operating officer at Lares, a security consultancy, says he's seen too many times where pen testers overload their customers with so much information that they don't wind up doing anything with the results.

"Too often people receive that 600-page report and it looks like a vulnerability scan; they don't know what to do with it," says Quentin Rhoads, director of professional services at Critical Start.

Hay and Rhoads say the best pen tests are targeted. So start with a scoping interview where you identify what you want to get out of the pen test. If you don't get pen tests every year, it's unrealistic to think you'll be able to fix everything in your network from just one test.

Here are seven tips that Hay, Rhoads, and Rapid7’s Tod Beardsley offer up to companies looking get their money's worth out of a penetration test.

 

 

 
Next slide
Recommended Reading: