Does your organization have a bring-your-own-device policy? Do your employees use external storage devices? How do you protect workstations, servers, and mobile devices that connect to your network? The perimeter of businesses today only keep expanding – and so does the use of endpoint protection. Is endpoint protection the best way to protect your network, though?

The Rise of Endpoint Protection

With the number of endpoints with the ability to connect to your network, endpoints are becoming a common, easy entry point for cyber attacks. Greater visibility, control, and security is needed to prevent attackers from compromising your network.

A trend within the industry that we see is the implementation of endpoint protection platform (EPP) solutions. Makes sense, right? If endpoints are the vulnerable access points, put something in place directly at the device level to protect them. Cisco’s definition says, “An EPP solution is known as a preventative tool that performs point-in-time protection by inspecting and scanning files once they enter into a network.” EPP solutions include antivirus, anti-malware, data encryption, personal firewalls, intrusion prevention, and data loss prevention. Most EPP approaches identify threats based on known file signatures for newly discovered threats.

The next level of endpoint protection is endpoint detection and remediation (EDR) solutions. Cisco’s definition says, “An EDR solution goes beyond simple point-in-time detection mechanisms. Instead, it continuously monitors all files and applications that enter a device.” EDR solutions go a step further than EPP by providing more visibility and analysis for threat investigation. Even more so, EDR solutions can detect threats beyond just signature-based attacks, including fileless malware, ransomware, and polymorphic attacks.

Most endpoint protection solutions offered today now combine EPP and EDR solutions, but implementing endpoint protection alone doesn’t make a comprehensive information security program. Endpoint protection should be just one component of a full-spectrum of security solutions and processes that stop targeted, advanced threats.

Benefits of Penetration Testing

To get the most out of your information security program and processes, consider undergoing regular, advanced penetration testing. The findings from penetration testing can actually help you remediate the common vulnerabilities that malware and APT groups rely on to exploit endpoints – not just prevent the threats, like EPP and EDR solutions provide.

Threat groups are constantly evolving their tooling and malware, which endpoint protection struggles to keep up with. Once an attacker is inside your network, they can move laterally and find what they want or need. Don’t you want to do everything possible to keep them from ever getting inside? If your organization can harden the underlying vulnerabilities that are found during penetration testing, that will mitigate entire threat categories at the root, rather than having to react any time an iteration of a threat is detected.

Remediating findings from penetration tests could be substantially cheaper than relying on a third party security layer to (hopefully) catch the latest iteration of a threat. If you use qualified, skilled penetration testers, they will find and exploit the vulnerabilities that an attacker will use, plus provide remediation tactics for the vulnerabilities found. If your security budget is tight, penetration testing may be a more effective solution for you than endpoint protection.

A penetration test itself won’t fix your security problems, but when you use the findings to mitigate vulnerabilities, you are going beyond endpoint protection. We do acknowledge, though, that there is great value in endpoint protection. If you choose to utilize EPP or EDR solutions, it’s crucial to find one that integrates with your other security measures. When vulnerability, patch, and configuration management can be cohesive with endpoint protection, you’re getting a more comprehensive solution.

If you’re interested in getting the most of your information security program and pursuing advanced penetration testing, contact us today. Our team of expert penetration testers will find and exploit your vulnerabilities in order to provide remediation guidance so your team can protect your network.

More Penetration Testing Resources

The Dangers of End-of-Support Operating Systems

How Can Penetration Testing Protect Your Assets?

When Will It Happen to You? Top Cybersecurity Attacks You Could Face

Investing in regular penetration testing is oftentimes a hard pill to swallow. You’re paying someone to break into your networks, systems, or applications. You might find that your secure technology isn’t as secure as you thought. Your ever-changing, complex environment might create more vulnerabilities than expected. Plus, you might not even be sure what you need or who should perform the testing. Though undergoing penetration testing may seem daunting, there’s one thing that we know for certain: penetration testing is vital for protecting your assets. Let’s talk about some issues with penetration testing, like how movie and television have changed our perception of hacking, how scoping impacts your assessment, and how a penetration tester could hold you back from receiving a thorough assessment.

1. Hollywood Hacking Myths

The entertainment industry has given the world a very unrealistic view of how hacks happen. Whether it’s in a James Bond movie or a ransomware attack in Grey’s Anatomy, Hollywood’s depiction of hacking isn’t an accurate representation of anything you’d really see. Even if the scene uses correct terms or buzzwords, the 3D interfaces, multiple pop-ups and screens, and fast typing diminishes any realistic elements.

“Hollywood hacking” has given people the idea that a malicious attack happens quickly and is easily-stopped. In reality, if a person, company, or asset is being targeted, the attacker is going to try everything in their power to break in. They have time on their side, so they are going to continue to attack until they are successful. It could take weeks or months, but once they are successful, they can compromise your data and your reputation.

Because we know that malicious attackers are going to go above and beyond to get what they want, so do our penetration testers. Through ethical, permission-based hacking, we try to find any vulnerability that could be exploited. We often take a more unconventional approach than you might find in other firms, all with the goal of providing the most thorough assessment possible. We think outside of the box. When we hit a wall, we try to find a way around it, through it, over it, or under it. Where others might throw in the towel, we continue to brainstorm to find a way past the barrier.

2. Proper Scoping

While it’s true that no security service can 100% guarantee that all vulnerabilities have been found, it’s crucial that a thorough, quality-based penetration test be performed. This is always dependent upon proper scoping. If you’re testing your network, how many active hosts are there? How many devices are in the network? Does your mobile application include APIs or web applications? Do those need to be tested separately? When going through the scoping process with a security firm, they’re going to ask lots of questions, but the goal is to give you the most accurate, thorough penetration test as possible. After all, security audits are a financial investment, why pay for something if it isn’t comprehensive?

3. Proper Penetration Tester

Oftentimes, penetration testers can become frustrated when they encounter barriers, so they give it a few tries and then move on. This is common when testing APIs, web applications, and mobile applications. So many professionals within the security field lack the knowledge and experience to assess these environments properly. They give up and run a vulnerability scan, which will find the low-hanging fruit, leaving the harder to reach bugs active in the environment. It’s usually these types of vulnerabilities that are exploited, causing serious damage to a company’s reputation and financial stability. The organization thinks, “But I had a penetration test done! I should have been safe!” In reality, the penetration test delivered to them was merely a vulnerability scan with a few glances from so-called security experts.

Quality penetration testing needs to be performed by a skilled professional or group of professionals who can analyze the results of security testing activities and use those results to inform future activities. They also need to have the drive to dig deep. Discontent with the base assessment, our penetration testers dig deep into the networks, systems, and applications, looking for those vulnerabilities that might cause you to lose sleep at night. Our goal is to excavate those issues that would otherwise lay dormant until someone seeks to exploit them.

Quality Over Quantity

When I’m asked what the difference is between penetration tests from KirkpatrickPrice and other security firms, my first answer is the focus on quality. Quality is the key aspect of providing a solid penetration test. This is becoming a rare find as more and more security firms become focused on quantity over quality.

In a day and age when security controls must be strong and effective against advanced threats, we’ve made it our mission to deliver quality penetration tests. When looking for your next penetration test, consider KirkpatrickPrice’s quality-based approach instead of the typical “scan, report, repeat” assessments.

More Penetration Testing Resources

Not All Penetration Tests Are Created Equal

How Can Penetration Testing Protect Your Assets?

Components of a Quality Penetration Test

Auditor Insights: Vulnerability Assessments vs. Penetration Testing