Penetration testing is one of the best ways to test your company’s cybersecurity. You never really know how secure your network might be until someone tries to break through. Penetration testing allows that to happen in a simulated and controlled environment. However, it is still very important to choose the right penetration testing providers with whom to do business. Here are the main criteria that you should use to make the choice.
Properly Qualified Technicians
First of all, you need to make sure they have the right people for the job. Anyone can claim that they are a qualified penetration tester, but you need to make sure they can prove that. It gets a little confusing here because there isn’t a single certification. In fact, there are multiple certifications (from multiple organizations) that are considered to be sufficient. As long as your technicians have one or more of the certs on this list, that should be sufficient.
Good Reputation
When you employ a penetration testing company, you are mostly employing people known as “ethical hackers.” Of course, you should always do some background work to make sure they are indeed “ethical.” You can do this by checking the company’s reviews. Mainly, you want to make sure that they haven’t been involved in any data breaches, shady behavior, etc. It also wouldn’t hurt to do an independent background check on the technicians who will actually be working on your system.
Insurance Matters
Although the purpose of a penetration test is to simulate a cyber-attack, it is important that no actual harm be done. However, accidents can occur, and it pays to choose a company that is prepared for them. Make sure that their services are covered by a liability insurance policy. That way, if something does go wrong, you won’t be on the hook for the damages.
Any testing company that refuses to acknowledge these risks is likely to be substandard or even dishonest. There is always a certain amount of danger in penetration testing, although it is rare to experience anything worse than a short network outage. In some cases, penetration testing might be covered by your insurance company. If so, those costs will likely be classified under “errors and omissions.”
The Importance Of Manual Testing
If you have a lazy penetration tester, they may simply choose to rely on automated tools. This should not be accepted, as they are just letting the AI do all the work. Automated tools can and will be used in any good penetration test, but manual testing is required in order to confirm those findings. These two methods must be used together to obtain the best results. Automated scans and things like that are a great place to start, but you want to make sure that your testers perform all the manual checks as well. If they aren’t willing to put in the work that it takes to do a realistic test, they don’t deserve your business.
Retesting Policies
Most of the time, a penetration test will uncover minor problems that need to be corrected. Obviously, the next step is to correct those vulnerabilities. In fact, that “patching up” process is the entire reason that penetration testing exists. However, it never hurts to confirm things one more time. That is why you should look for a company that has a comprehensive retesting policy. You already know that you will want a follow-up test to confirm that you have corrected the problems found during the first test. As such, it’s better to negotiate terms beforehand, and any reputable company will allow you to do so.
Look For Good Planning
When you hire a penetration tester, you do not simply “turn them loose” on the systems to be tested. As they say, random actions tend to have random results, and that isn’t what you want here. It is very important to work out a plan with your penetration testing company beforehand. This plan should specify the exact systems and components to be tested, any specific “rules of engagement”, and the methods/tools that will be used. With something like this, it is very important to understand what is going on at all times. A good plan allows you to do that, even if you don’t have a deep knowledge of IT.
Good Communication
When a penetration test is being done, the technician should keep the client informed as much as possible. Whenever anything significant occurs, they need to communicate that information to one of your representatives ASAP. Not only does this indicate honesty and efficiency, but it also gives you a chance to make any important decisions that need to be made. Any penetration tester who doesn’t keep you well-updated should not be used again. Likewise, the company itself should be responsive and communicative at all times. You are trusting these people a great deal, and so you have every right to be kept informed of all significant developments.
Conclusion
There are other factors that might be used to evaluate penetration testing vendors, but we feel that these are the most important ones. In particular, finding a company that is both qualified and honest would be of the utmost importance. If you are in need of a good penetration testing vendor, you can call PCH Technologies at (844) 754-7500.
Our Florida Office
As of 2022, PCH Technologies has opened up a new location in Fort Lauderdale, FL in order to serve the South Florida Market. This expansion into the South Florida market aligns strategically with our plans to continue to grow a national presence as a managed service provider (MSP).
The growing South Florida region includes Miami, Fort Lauderdale, and West Palm, creating an opportunity for PCH to fulfill the expanding needs of the market.
Florida Office
101 NE 3rd Ave Suite 1500, Fort Lauderdale, FL 33301
Email: [email protected]
Phone: 954-777-8830