1

I am trying to find explicit recommendations on the frequency of penetration testing, if possible in an industrial environment.

I looked in ISO/IEC 27001, NIST SP 800-115 but could not find any information on this except that "It depends".

While I totally understand and somewhat agree with this statement, especially since every environment is very different and I did not specify a type of audit (ie. External pentest, Internal AD pentest, Applicative pentest, Physical intrusion, Social engineering campaigns, password cracking audit etc.), I would still like to know if such information exists or not.

Improve this question
3
  • Pentests are not audits. Social engineering is not a pentest. Password cracking audits are not a pentest. You are mixing audits, pentests, assessments into a single concept, and that will make it even more difficult to answer than it already is.
    – schroeder ♦
    Commented Apr 18 at 9:14
  • I used to be a pentester and agree that audit and pentest are two different concept but one could argue that a pentest can be considered an audit still (at least in my native language). I could have simply stated "testing" but it would have put a weird title. I am not mixing anything and am pretty sure that my post was perfectly understandable even with this "shortcut".
    – Falquiero
    Commented Apr 18 at 9:54
  • 1
    "How often should you schedule an internal AD password audit?" is a fundamentally different question (and answer) to "how often should you schedule a pentest?" Hence, there is confusion or your question is not properly defined. There could not possibly be an answer to what you asked in a standard because you are not defining "pentest". There can't be "explicit recommendations" in standards for something not explicitly defined. If you had asked about the frequency of an external pentest, there are answers to that in standards.
    – schroeder ♦
    Commented Apr 18 at 10:58

1 Answer 1

Reset to default
4

The concrete advice is "whenever there is a material change to the environment".

The practical advice is "whenever you are able to deal with the results".

The risk-based answer is "the distance between tests, audits, and assessments is based on your risk tolerance that you are unaware of a material issue or a KRI that would aid you in making a decision about that risk in order to control that risk".

For some "targets of evaluation" and some organisations, it makes sense for them to do continual pentests 24/7. That's why bug bounty programmes exist as well as automated tools that can continually run. Red teams are hired to do all of this all of the time. And so on.

For other organisations, the risks are lower, changes are less frequent, and even if they had 24/7 testing, they wouldn't have the resources to respond, resulting in the risks costing less than the testing.

So, "it depends". It depends on the risks involved and the balance of the cost of the risks compared to the costs to control those risks. And that is a pretty universally applicable answer when it comes to cybersecurity.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .