This is a good question as I think many places approach the pen test
incorrectly. This has become even worse because the executive level of many
organisations tend to believe the pen test is a silver bullet - if you have a
pen test and the results show that there was no successful penetration of any
system, then your security is OK and we can all tick that box. On the other
hand, if the pen test fails, then the security team are not doing their job.
This simply isn't the case.
A pen test is just one tool which can be used to assess the effectiveness of
your security controls. It does not tell you that all your systems are secure
and the level of confidence you can place in that pen test depends heavily on
both the skills of the pen tester and how well you have specified and planned
the test. The absolute worse thing you can do is simply call some security
company and say "Hi, I want a pen test, when can you do it". Prior to engaging a
pen tester, you need to have a clear idea of what you expect from the pen test,
what your priorities are and what information you want in the final report. You
also want to approach more than one provider. What you are looking for is
someone who is able to demonstrate they have the right skills, who can
understand your requirements and who is able to provide you with a result which
can assist you in improving your security posture. A pen test should not be
thought of as a 'test' in the sense of either a pass or a failure. Essentially,
you need to have a clear understanding before the test of what the grades are
and on completion of the test, have sufficient details and information to help
you focus on how to get a better grade in the next test.
One of the most difficult aspects of pen testing is that the quality of the pen
test is vary much determined by the individual performing the pen test. I have
switched security companies primarily because an employee of the first company
has changed employers and that individual was someone we knew could do a good
pen test for the organisation (usually because they were talented and good at
their job and because they understood our business).
Engaging a pen tester is in itself a skill. You will get better at it each time
you do it provided you approach the task with clear objectives. Knowing your
current security posture is only one part of the equation. You need to have a
clear idea of what your final target state is. What you want from the pen test
is increased clarity regarding your current posture and sufficient information
to help you develop plans to move the organisation to the desired state.
A good pen test provides you with details of what was done, what succeeded and
what failed. It should not just be a list of possible vulnerabilities or systems
which are not at the latest patch level or examples of 'poor practice'. All of
that can be obtained with simple vulnerability assessments. It should provide
full details of how the environment was penetrated and suggestions of what
controls could be implemented to prevent or reduce the likelihood of repeat
occurances or the impact from these occurances. The pen test report should
provide sufficient details that you can assess whether a failure to gain access
was because the controls are adequate or because there was not sufficient time
allocated or because the scope was too limited etc. In many respects, what you
are looking for is a partnership with the pen tester where they are working with
you to improve your security.