How to select the best penetration testing company for your business

Finding the best penetration testing firm for your project

In today’s day and age businesses are becoming more familiar with the term “penetration testing” and in general most IT managers, CIOs and C-Level executives have a good understanding of the pen-testing concept. However, it is still common for companies to confuse security assessments with penetration testing (Penetration vs Vulnerability Article Here ). If at the end of the day an organization has defined that their main objective is to evaluate the security of a computer system, network, app etc and clearly understands that the goal of a penetration test is to simulate a real world attack (exploit potential vulnerabilities in your organization’s systems), then the next step is to begin vendor selection. Basically, it’s now time to evaluate penetration testing companies, budget and how best to move forward with the right company or individual who specializes in ethical hacking. View Top USA Penetration Testing Companies here.

So why would a company want someone to simulate an attack on their systems?

There are many do-it-your-self applications available and having the capability to run your own penetration tests can be good idea to run self-vulnerability tests whenever you make changes to your network…but a company that wants to know if their data is truly safe (client data, financial data, medical data and systems) and protected from real world hackers should seek out professional help. One of the most powerful strategies a company can deploy is 3rd party penetration testing.

The news is riddled with big name companies getting attacked and exposing customer data to hackers. According to eSecurity Planet‘s 2019 State of IT Security survey, 64 percent of organizations conduct pen tests at least annually, so as many as 36 percent of organizations are taking unnecessary risks by ignoring best practice security measures.

Even if your internal IT team has penetration testing experience and you have some in-house pen-testing tools, experts believe that a third party performing controlled penetration testing is more likely to uncover cracks that hackers will also discover, if they (hackers) haven’t already found them.

Penetration Testing – Scoping

Since scoping/project details will vary based on customer expectations, i.e., number of IP addresses, systems and other factors, it is virtually impossible to provide an out of the box “one size fits all” pricing quotation. A solid pen-testing company will want to know at the very least -preliminary information and customer requirements in order to provide the most accurate quote/timeline and expectations. Be wary of a “one price fits all” pen-test as these low price solutions that fit any scenario are most likely using an automated scan and just checking off boxes.

Initial Vendor Outreach

• Be prepared to discuss project details and answer penetration testing questionnaires. A penetration testing company with experience will ask the right questions, honing into your project and the questionnaire itself should be almost painless. If your company requires a NDA, most pen-testing companies understand that project details are sensitive in nature and will (should) provide a mutual NDA.
• Don’t expect to find the best Penetration Testing company for your project via email only. You will need to schedule an introductory call. During the intro call you should discuss initial project scoping, find out if the pen-testing engineers are senior or junior level and also discuss pen-testing strategies and procedures. Typical discovery calls are about 30 mins.
• Be specific and know your project scope. An expert penetration testing company will want to know specific scoping details so that the pen-test will be aligned with your project goals, and until they know those details, its doubtful you will receive an accurate, competitive pricing quotation.
• Ask for samples of previous redacted penetration reports. Most penetration testing companies will share reports provided you have a Mutual NDA in place
• Ask for certifications of lead engineer.

Statement of Work / Scoping Outline

A solid penetration testing scoping document will contain details on tests to be conducted along with an overview of objectives. The statement of work also contains pricing/ retest information and time expectations. It is recommended that you discuss budget and limitations prior to receiving the SOW.

Prior to receiving the SOW draft expect that the penetration testing company will want to schedule a SOW review call. Once you receive the SOW, Don’t shop it around to other companies. Its a small industry and improper to share details with other companies. It’s OK to get a few quotes to compare and is recommended, however confidential information is confidential.

Penetration Test – Kickoff

Once you have accepted Statement of Work, a quality penetration testing company will issue a Rules of Engagement Letter (RoE). Within this document all scoping details will be outlined and details will be presented so that both company and vendor expectations are aligned. Scheduling timeline will take place and service will begin as scheduled. A pen-testing project manager should be assigned and to your project and this person will be the relay between the pen-testing engineering team and your company.

Penetration Process:

Your company should be fully aware of the process once service begins. The penetration company you selected should alert you of critical vulnerabilities immediately when found, and in addition should keep you posted during each step of testing phase.

For a complete overview of penetration testing process please view: Redbot Security Penetration Testing Process

---

Here is the List of Top 10 things to consider when selecting the Best Penetration Testing Company

 

1. Engineering Certificates
2. Senior or Junior Level Experience
3. Methodology
4. Reporting Format
5. Vulnerability Scanning or Manual Penetration Testing
6. Removal of False Positives
7. Quick Response and Client Engagement
8. Based in USA
9. Emphasis on Customer Satisfaction
10. Retesting Included

 

---

 

Penetration Testing Terminology

Typically there are 3 variations of a Penetration test:

1. Black Box Penetration Testing: A penetration testing company will have very limited knowledge of the testing environment and any information they gather will be on their own without client helping with information.
2. Gray Box Penetration Testing: Gray–box testing (International English spelling: grey–box testing) The client has provided the penetration testing company with partial knowledge of systems such as IP addresses, credentials for testing application authentication, etc.
3. White Box Penetration Testing: Client has provided penetration testing company with details such as network diagrams, API list, etc
   

 

---

 

Why is it important to select the best penetration testing company

 

#1) Your Data and business operation is critical, therefore its important to select only a highly skilled penetration testing company

#2) Vulnerability scans do not simulate real world hacking methods

#3) Its critical to know what a bad actor will see, not only from an external perspective but also if they were to get into your internal network.

#4) The Best Penetration Testing Companies will help outline best practice remediation steps so that you are able to quickly fix the exploitable vulnerabilities.

#5) Junior, inexperienced Penetration Testing Companies lack network knowledge. They may know some tricks to exploit but they wont be able to explain how to fix things.

#6) The Top Rated Penetration Testing Companies validate all findings and provide proof of exploit

#7) The Best Penetration Testing Service Providers Remove any False Positives

#8) Penetration Testing Companies should provide Retesting of Remediated Vulnerabilities in their service module.

 

There are various types of Penetration Testing.

Internal and External Network Penetration Testing: This penetration test will find Internal and External network vulnerabilities in the network or infrastructure of the system. Some critical vulnerabilities include weak passwords, outdated systems, updated patches not applied, SMB signing issues, etc.

Wireless Network Penetration Test: Wireless Penetration Testing is a proactive step your company can take to ensure the security of your wireless networks. When seeking a company to test your wireless, DO NOT SETTLE FOR REMOTE BOX TESTING. Onsite testing is the only option for a complete and comprehensive wireless network penetration test.

Application (Web Mobile) Penetration Test: Ensuring that your web applications are secure is an critical part in maintaining your company’s security posture. Bad Actors will attempt to compromise your web applications and ultimately connect to your internal network, databases and sensitive client information.

Social Engineering Penetration Test: This comes in a variety of flavors from physical onsite testing to electronic phishing (email Spear Phishing campaigns) to Vishing (phone calls/texting) There are many SaaS services that provide out of the box phishing training and campaigns however there is no substitute for manual controlled spear phishing and vishing services. Know what you are paying for: real-world hacker techniques or SaaS automated training campaigns.

ICS/SCADA Penetration Testing: ICS are found in many industries such as electric, water and wastewater, transportation, oil and natural gas, chemical, pharmaceutical, and manufacturing (e.g., automotive, aerospace, etc). Because there are many different types of ICS with varying levels of potential risk and impact, there are many different methods and techniques for securing ICS, one of the most important method is Penetration Testing.

Conclusion

Finding the Best Penetration Testing company is really finding a Penetration Testing Company that is Best for your project. Your network might not be critical infrastructure (power/water plants etc) however your network is critical to the health of your business. Its important to ensure that the engineers that are working on your systems have a in depth knowledge of not only penetration testing, but also understand how your network/application details, structure and systems.

One of the most important item when selecting the best penetration testing company for your project is to know if they are selling you a vulnerability scan or true Manual Controlled Penetration Testing. In addition if you select the wrong company you may end up with a 1000 page report of false positives and non validated vulnerabilities that are generated from a scan. This is useful information for —– NO ONE. So don’t feel so bad if your company has fallen prey to the low cost scanning methods of Junior Level Techs.

Next time you’ll make the right choice.

Contact Redbot Security Here

View Cost and Service Comparison List of Top Penetration Testing Companies Here