How often should you conduct penetration testing?
What is a good rule of thumb to follow for penetration testing for IT security? How often is sufficient vs. being a waste of resources?
Answers
Depends. Some certifications lay out specific requirements for pentesting. In general, I would mirror many certifications and say annually. If you make major changes to your network, I would think it would be wise to conduct penetration tests. One thing to keep in mind if you use AWS or other cloud service, you probably need to get approval first and make sure that you don't violate your TOS by conducting penetration testing out of the blue.
- Share this answer
- Permalink
Related Questions
Is Palo Alto the only true NGFW? SonicWall? Juniper SRX? Do you think that Gartner's definition of a NGFW is correct? Does anyone know...
I've been in IT for awhile, and am considering a shift to focus more on security and related technologies, policies, etc. What kinds of...
Are there reputable security applications out there for BlackBerry, Android, and iPhone that will protect my business emails, chats, and...
Yes, it's true that everyone should know better, and should be backing up data to an off-site facility on a regular basis. But, in...
Cloud computing security is approached from two directions; the cloud provider, and the end user. Regarding the provider, our strategy...
Ask a question
White Papers & Webcasts
White Paper
Bullet-Proof Your Enterprise Linux Environment
White Paper
How to Avoid the High Cost of Security Audits
White Paper
Business Assureance Technology Infographic
See more White Papers | Webcasts
Here's a page with some good penetration testing information:
http://www.penetration-testing.com/home.html
"Most people that find their way to this page do so because either they have been told they need to get their information systems tested to prove they are secure, or their systems have already been hacked and they want to understand what happened.
In both cases you'll be pleased to hear that the information in this guide should help you to quickly understand the choices you have available to improve the situation.
What is penetration testing?
The term "penetration testing" is an industry buzzword, which used to mean something quite specific, but is now commonly used by customers to refer to just about any type of security testing. We won't be bucking the trend either; we know a dead horse when we see one.
The general process tends to be that your systems get tested, and then at the end you receive a report that highlighs all the insecure areas that need attention, along with advice on how to fix them."