News

Aug 27, 2023

Why Small Businesses Need Penetration Tests

Don Lupejkis is a Solution Architect with CDW’s InfoSec Security team. His passion is helping organizations on their journey to a more secure environment. Christine Prisco is a Program Manager for

Don Lupejkis is a Solution Architect with CDW’s InfoSec Security team. His passion is helping organizations on their journey to a more secure environment.

Christine Prisco is a Program Manager for CDW’s Product and Partner Management practice. She works with cybersecurity solutions to enhance products, services and initiatives to better serve our customers’ needs.

Penetration testing is a vital starting point for every organization’s cybersecurity strategy. Pen tests help companies pinpoint network vulnerabilities and deliver guidance on how to fix them.

One challenge is ensuring that the tests cover enough ground to identify key compromised areas. Another is getting a report from the testing partner that’s comprehensive and easy to understand.

When a business recognizes the need for a penetration test but doesn’t get the results it needs, it receives no benefit from having the test performed. It’s a bit like going through an invasive medical exam only to receive a diagnosis in a foreign language.

To avoid that fate, here’s what you should know about making the most of a penetration test and how to find the right pen testing partner.

Click the banner to discover BizTech's list of small business IT influencers.

A penetration test is an assessment of a network’s security. When performed by a third party, a pen test involves a certified ethical hacker who attempts to breach either interior or exterior business networks (depending on the type of test performed) to identify potential points of compromise.

Penetration testers are trained to think like hackers, and they use the same methods as their malicious counterparts. The concept is similar to safeguarding your house: To burglar-proof your home, you might want advice from someone with experience breaking into homes.

This is because there’s a difference between trying to prevent an attack and looking for weak points. What may appear to be secure may actually be vulnerable — finding out is all in the approach.

When it comes to penetration testing, two misconceptions are common.

First is that pen tests deliver largely the same results, regardless of who runs them. But the expertise of testers make a big difference in how they approach network attacks and what they find.

Second is that great pen testers are enough on their own. The reality is that even top-tier testing won’t improve defenses if it’s not paired with comprehensive reporting. It’s vital that testers detail everything they do because businesses need to know what was tested, how it was tested, and where it failed.

UNPACK: Find out how IT leaders are reimagining their cybersecurity infrastructures.

Don Lupejkis Solution Architect, CDW

There are several common types of pen tests, each with its own purpose:

DISCOVER: What small businesses need to know about cyber insurance.

For many companies, aiming for a complete penetration test once per year is a reasonable goal based on budget resources and time constraints. If possible, every six months or even quarterly may be advisable.

In many cases, however, even annual penetration tests don’t happen. Budgets are one problem, as TechRepublic reports, with 1 in 3 companies citing money as their reason for not conducting the tests more frequently. Some organizations may think, if it’s not broken, don’t fix it. But while weak networks may not look broken on the surface, many will show cracks under even the slightest pressure.

Finally, there’s still a pervasive concern about security uncertainty; many companies don’t want to look like they don’t know what they’re doing. The problem here is that avoiding penetration tests because they could reveal unknown issues doesn’t solve the problem, it simply keeps companies in the dark.

Christine Prisco Program Manager, CDW

EXPLORE: Find out how IT leaders should strategize during a period of economic uncertainty.

Picking the right penetration testing partner is critical for getting actionable results. But how do companies know who’s good and who’s not?

Start with experience. Providers with more industry experience and expertise are typically more thorough and more trustworthy. Next, assess the tester’s transparency. Companies should ask for a sample report to see how testing results are delivered. If a pen tester won’t provide this, walk away.

Finally, make sure to look for a provider that prioritizes privacy. This means that your penetration testing results should be given only to the individuals you designate and should not be shared among the provider’s internal teams or with your workforce at large.

Simply put, penetration testing should be a top priority for businesses that want to understand where they’re vulnerable to attack and learn what they need to do about it. By partnering with an experienced provider, companies can get actionable data that is well worth the cost.

This article is part of BizTech's AgilITy blog series. Please join the discussion on Twitter.