Who should be doing penetration testing?

This is a question; one important thing to realize here is that anyone who has knowledge of security, is kept updated with the day-to-day vulnerabilities, has performed pen testing activities in the past, is well versed in vulnerabilities and, moreover, is a person with experience and good certifications is preferred for such activities.

There are two things that one can do while considering this: either one can start an in-house security division that will perform penetration activities regularly and also monitor any active threat and identify and mitigate them in real time, or hire an external party to perform the penetration testing activity once, annually or quarterly. Invariably, the best and cost-efficient way is to have an internal testing team that has knowledge of penetration testing and can perform real-time assessments with the help of CERT, Exploit-DB, NVD, and more. Having a security team in place is always better than not having anything in place; like it's said, a bit of prevention is better than no prevention.

When we talk about outsourcing, we need to understand that this activity will happen once a year or four times a year based on a quarterly exercise and this, generally, is a very expensive activity. One needs to carefully assess the scenario and decide whether an external entity is effective or an in-house team will be effective; both have their own pros and cons. One of the criteria comprises of the trustworthiness and maintaining the confidentiality of the flaws found by the people coming to the organization to pentest; one never knows the other person's motives. Also, a lot of thought has to be put into ensuring that information is not leaked out when the activity is outsourced. One also does not get a clear understanding of their underlying infra when this activity is carried out once a year; it just gives a picture of what the organization looks like at that point in time.

There are a few misconceptions about the security of networks and devices that everyone needs to be clear about:

• Nothing is 100% secure
• Deploying a firewall will not make the network 100% safe from intrusion attempts
• IDS/IPS do not provide a 100% safeguard from attackers
• AV does not always help protect your systems from 0day attacks
• Not being on the Internet also does not completely protect you from attacks
• Performing annual testing also does not provide security for another year