What are the advantages and disadvantages of having an internal pentest department in a large company compared to external service providers?

  • 3
    3rd party pentesters have zero office politics to worry about, and are less likely to be friends with developers and environment admins. Oct 13 '14 at 19:42
  • 1
    Yeah, you'll want to go with 3rd party. Your company would have to be MASSIVE to hire your own full-time pentesters, unless security is absolutely imperative. In that case, you'll have your important machines air-gapped, so you won't have much to worry about.
    – KnightOfNi
    Oct 14 '14 at 0:29
  • 1
    I think a lot of companies would prefer to hire a skilled pentester, but this is just not possible. Pentesting firms and silicon valley eats up the top talent. You'll be lucky to find someone who can hack their way out of a paper bag.
    – rook
    Dec 3 '14 at 16:42
  • 1
    Don't forget about the level of pen-testing you're trying to accomplish. Most "pen-testing" that organizations are looking at revolve around meeting compliance standards, which from experience is nothing more than vulnerability scanning and remediation. I also feel internal testing teams are asked really for application testing, and not necessarily a full test. Jan 2 '15 at 22:00

The most-effective use of a security professional who has penetration-testing skills is to host cyber exercises. Some are referring to this as purple teaming or adversary simulation. Each approach will be unique to an organization or set of organizations -- and have their own advantages and disadvantages.

Rafael Mudge recently spoke at the SANS Pen Test Hackfest on [PDF - Hacking to Get Caught - PDF], based on his original material from a blog post on adversary simulation.

I don't think it matters if you hire externally or internally for this sort of work -- the benefits of hiring someone internally have historically been discouraged because the individual would "likely become bored", "become predictable", and become less effective because his or her knowledge of the environment would prevent seeing things from a new or fresh perspective. However, with cyber exercises proving their value in Security Operation Centers, fusion centers based on cyber threat intelligence, and internal red teams -- the value of having in-house penetration skills is rapidly rising.

There are a few resources I'd like to point you towards in order to fully comprehend the tradtional and non-traditional approaches to penetration testing resourcing. Two books, one: "CISO's Guide to Penetration Testing: A Framework to Plan, Manage, and Maximize Benefits", and the other, "Effective Penetration Testing" by Kevin Pescatello and Matthew Larsen. In the former book, chapter 5 covers four types of tests: parallel shared, parallel isolated, series shared, and series isolated. Each of these test approaches include two types of outside penetration testers as well as one internal type -- blending a mix and balance of requirements and needs.

Lastly, I'd like to note that penetration testing is an emerging and changing field with a variety of expertise coming from many unorthodox approaches and a myriad of backgrounds. Having been introduced to US national intelligence, national security, and military TTPs such as wargaming, OPFOR, red teaming analysis (RTA), game theory, simulation, warning intelligence, S&TI, TECHINT, all-source intelligence, counterintelligence, MILDEC, counter denial, counter deception, analytical frameworks, and the fusion center model -- I have concluded that the penetration testing industry is due for a total rewrite. These antiquated third-party assessments that produce reports have always been laughable when compared to warfighting, so it is precedent that we embrace change, particularly due to this 2014 cyber war and the total cyber risk situation we are facing as a global economy or in the geopolitical space.

  • 2
    I think this answer is good, and I'd add that having in-house testing gives you the advantage of having in-house knowledge. As Atdre points out, having a nice report with the results of the pen test are of limited value. Having people inside your organization that work with your developers to improve security, and perform pen tests as well as other assessments is far more valuable IMO. Jan 2 '15 at 20:13
  • Having an appsec-focused approach to testing and remediation has been considered operational excellence for many years now. However, I believe even appsec is due for a refresh -- this foreknowledge comes from my introduction to the finer points of the FAIR model (or well, any sufficiently analytical-based risk model). The main problem for appsec is integration into a cyber risk platform. The shift used to be a greater need for sec-focused appdevs but it is quickly moving to the opposite: tech, analyst, or managers must understand the threats and targets as deeply as possible.
    – atdre
    Jan 2 '15 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.