Why you need to know about Penetration Testing and Compliance Audits?

As such, you can just imagine what all of that entails and the
weight that data receive, especially when it comes to a decision
making on how to handle this fairly new and arguably invaluable
resource.

Of course, we are well aware from a very young age that our
water needs to be pure, filtered and possibly protected, so this
pops the question and makes us wonder:

How exactly does all of this translate for our data, its
handling processes and ultimately our Security?

It is no secret that our personal information is as valuable if
not more than actual currency. Imagining your social security
number, medical bills or paycheck amounts flowing through vast
amounts of seemingly random servers all across the globe can be
unnerving.

It brings out the same questions that we would have for anything
else of value:

Where is it going?
Who can see it?
Why are they holding it?
…
Is it safe?

As with anything else, the best way to understand is to get
examples, more importantly from a person who is experienced and
deals with these types of questions about your data every day.

Let’s assess a small visit to your local hospital.

You check in.

What did you just do?

You gave away your social security number, address, bio
information, and financial status.

Did you stop and think if the hospital really needs all of that
information or are they just hoarding it for no reason?

Of course, you did not!

Currently, you’re more worried about your well being and not
some hospital records. This happens more often than we would like
to believe. Being brought in situations from various types of
establishments where our data is not the first thing on our minds
when entering.

But what does all of this have to do with Penetration Testing &
Compliance Audits? We will get there soon enough.

For starters, know that people are working over the clock right
now analyzing these everyday situations that everyone is facing.
They are the ones that do ask questions about our data and how it
is handled in such proceedings when we can not.

These people range in various fields, from Security Engineers,
Penetration Testers, Auditors, HR Staff, etc.

Some of these titles, understandably, are not familiar to people
that are not interested in the IT sector, but nonetheless, as with
everything else, there will be a field to fit a certain need.

Here that need is “Security.”

But for now, let’s go back to the hospital for a bit.

After you left, what happened?

All of that information got stored somewhere, quite possibly
digitally.

For papers, we have lockers, for money we have safes, for vials
we have 24/7 protected laboratories.

Just what do we have for the data we just gave out?

We saw that the front desk person typed it in their computer.
Which means that now all of that information is sitting either on
their server at local grounds or has been sent off to random nodes
across the globe as we previously mentioned. But that still does
not answer the main question, how is it protected? Can’t someone
just barge in and take it?

In most cases, that would be improbable and somewhat difficult.
But, most examples are not all cases, and as will any Security
Engineer attest, we get more breaches like that than we would like
to admit. So how this happen?

Well now we got to the technical bit, how does one actually
steal all of that information and why are they able to.

First, they can steal it because the systems that hold it, like
anything else physical as well, has not had its security properly
checked! There is a loophole in the system.

This is where Penetration Testing comes along.

Secondly, why they are able to steal it is because there is data
there that should not be there in the first place.

This is where Compliance Auditing comes along.

Let’s talk about the first issue, lack of security measures
and/or checkups and how to prevent it.

Penetration Testing, as the name might suggest, is the act of
trying to breach the security of an object and steal valuable data
exactly as an attacker would do. This means using their methods and
tactics as well. But what is the difference? Penetrating Testing is
carried out by specialized and authorized organizations or
individuals to help businesses identify potential risks in their
system.

These specialized organizations or individuals (Penetration
Testers) would try to break in, as previously mentioned using all
of the tips and tricks that attackers would, and then they would
report to the businesses (whom they are working for) where all of
their weak areas are and more importantly how and why they should
fix them.

Basically, if the Penetration Tester stole valuable information,
that means that an attacker could do this as well. By covering all
of the vulnerabilities found previously by the Penetration Tester,
you are making sure that when the actual attackers try to break in,
it will be substantially harder or almost impossible because most
of the vulnerabilities have already been fixed.

We will take the hospital for our example again.

We left our personal information (data) in the hospital, and
they probably stored it. Malicious actors^[1]
just a few hours later know where that location is and they try to
break in. One of two things will happen, either they will succeed
(the penetration test might not have been conducted). Or in their
attempt, they found out that most of the ways they knew how to
break in have already been patched up and now it is a lot more
difficult or impossible, leaving them with nothing.

Now as for the first issue, imagine that the attackers did break
in, there were lack of security measures and a Penetration Test
beforehand was probably not conducted. What did they steal or
rather what can they steal?

They stole the following information:

• Name/Surname
• Date Of Birth
• Blood Type
• Address
• Credit Card Number

The major issue here is why did the hospital, at the first place,
stored the credit card number when surely it will not need the
credit card for constant use?

That is where the need for Compliance Audit comes. A compliance
audit^[2] is the complete and
thorough assessment of an organization’s (hospital in our case)
compliance to laws and guidelines set out by the respective
regulatory authority of that particular industry.

Compliance is mostly a set of security checklists, that a
company, for example, should follow depending on their type of
business.

For example, if it is a private hospital, they would have to
follow a medical type of compliance. If it is a broker firm, they
would have to follow a financial type of compliance and so on.

The medical type of compliance, in this case, would state that
there is probably no need to store credit card number, lumped
together with all of the other types of information and that each
type of data has their own type of protection checklist.

So if the compliance beforehand were conducted and followed, the
credit card number would probably not have been stored in the first
place, as they are not vitally needed. If this had happened, even
after the attackers broke in, they would not have been able to
steal such information because it simply did not exist. This way
you mitigate the risk of breaches.

Basically, only the information that is absolutely needed should
be stored. Similarly, businesses cannot keep their
employee’s records^[3]
forever if they have left. Every business should hire a compliance
auditor to understand the rules and regulations of their business
and carry out in a legal way.

On the other hand, it is not entirely up to the auditors to
conduct such thorough search, it is up to the company and its
general security sense to build up everything properly in order for
these kinds of tests and checklists to never be a substantial
issue.

Attacks could also come from inside a company as well. Mainly
from provoked, overworked or unsatisfied employees. These are the
most dangerous types of attacks because the employees already have
access to everything.

Basically, their psychological well being is extremely
important! Taking the time and effort to care for your colleagues
will make them less eager to betray you or your assets.

As a conclusion, we went through various scenarios that all of
those ambiguous titles above go through each day and hope you are
more understanding now of the importance of Penetration Testing &
Compliance for the security of your data than you were before!