"Testing" only won't do it.
- Risk Assessment
- Document information assets (systems, networks, infrastructure components, etc.)
- Identify threats to those assets (vulnerabilities, attack vectors, etc.)
- Examine and review how security controls and measures that are in place mitigate or eliminate the risk of those attacks (access controls, processes, policies, security standards, etc.)
- Identify security needs, remedies or areas for improvement
When categorizing assets, don't simply look at the importance of the service it provides to the organization (e.g. mission critical), but look at the risks that are associated with potential compromise, the value of the information, the impact of potential compromise. A system could be totally unimportant to the organization's daily business, but it might be of great importance in terms of the information it can provide to an attacker, if compromised. We had a running joke at the office - one of our pentest engagements wasn't going anywhere, the web servers and public infrastructure of the client were all rock solid, but we managed to compromise the CFO secretary's laptop. Interestingly, it had a copy of the company's financial statement - days before it was going to be officially released. Since the client was a publicly listed company... you know where this goes.
- Security Audit
Unfortunately, many forget that most issues can be identified by looking at things from the inside, rather than testing from the outside. A properly done audit may reveal issues that you might not be easily revealed during a pentest (let's have a look at the accounts defined for that Tomcat manager). Here are some basic points:
- Review configurations (servers, routers, switches, firewalls)
- Verify policies are enforced (e.g. make sure accounts of ex-employees have been removed, look at passwords and when were they last changed)
- Look at how backups are configured and done, encryption of sensitive data, how access control is implemented (including physical - badges and other seemingly unimportant items)
- Systems Lifecycle
Every time IT bring up a new system, add a network, or provide a new service, or decommission an old one, the infosec team must be involved to review, analyze and implement security measures. Make it a part of the process.
- Vulnerability and Patch Review
When you receive those security bulletins, if they contain items that are directly related to products/systems you've got installed, pay attention.
Also, don't "assume" all is patched on Tuesday - WSUS may work fine, but you've got to run some basic checks and look at the logs.
There are more items, but this is already too long, and I'm not writing a book. Additional things to look at:
- Security events, incident reports and incident response
- Security awareness days
- Security round-table (involving the CEO)