LRQA Nettitude Blog

By David Parsons | Security Consultant at LRQA Nettitude

With the improvements of vulnerability scanners and the ever-increasing proficiency of software such as WAFs and Intrusion Detection Systems, you may be asking yourself whether Penetration Testing is still a relevant way to ensure the security of your website. The following article discusses several proactive security considerations you should make when either creating, or maintaining a website and how Penetration Testing can be useful in this process.

Working on your company’s virtual IT security isn’t the only piece of the Information Security jigsaw puzzle. Whilst the bulk of your technical teams’ efforts should be filling in the centre of the jigsaw with things like firewalls, monitoring, endpoint protection, security testing, and more; an organisation's physical security can often get left behind. Whilst the centre of the puzzle is critical to your overall security infrastructure, if the little things like an unlocked server room or unauthorised access to the building are overlooked, then the whole security operation is jeopardised.

Below, we’ll step into the shoes of one of our expert Penetration Testers to find out his experiences with physical security failures and evaluate what went wrong, as well as what physical security measures need to be implemented to ensure a holistic cybersecurity plan is in place.

By Joe Donohue | Senior Information Security Consultant at LRQA Nettitude

For many defense suppliers, CMMC is another compliance headache. So, being asked to adopt a new set of practices is a tall order, especially for those organizations that recently put in a tremendous effort to meet the requirements of the NIST 800-171 framework. Fortunately, rather than being a massive change in direction, CMMC is the next logical step in the United States Department of Defense's (DoD’s) drive to secure its supply chain. So, with the proper approach, your organization can gracefully meet this new challenge and benefit by becoming more secure and resilient in the process.

As more organisations begin to understand the importance of maturing their cybersecurity strategy, the focus is shifting away from a more ‘compliance-based’ plan and is logically developing towards a reactive security posture with a more modern, proactive and continual assurance approach. Infrastructure penetration testing is a crucial part of an ongoing security assurance programme, as well as being a distinct step in the journey. 

In the following blog post, we’ll cover the reasons why an organisation would need an infrastructure penetration test, as well as the key as well as the key considerations that need to be made in advance of one.