Three different things
- Vulnerability scan. Software checks your site or systems against a list of known problems: old versions, missing headers, open ports. Fast and cheap, with false alarms and no context.
- Security assessment. A person runs the scans, checks every result, looks at what software can’t judge (a form collecting Social Security numbers with no privacy policy, a domain registered to an ex-employee), and writes a report in plain English with fixes.
- Penetration test. Inside a scope you sign, a tester actively tries to break in the way an attacker would, chaining weaknesses together to see how far they can get. Then a report and a retest after you fix things.
Which one you need
- A scan, continuously: anyone with a website. This is what monitoring does.
- An assessment, once and after big changes: most small businesses. It finds most of what goes wrong, because most of it is left open, not broken into.
- A penetration test, yearly or before launch: businesses holding client or patient data, stores and portals taking payments, anyone whose insurer, clients or compliance program asks for one.
Questions to ask any tester
- Will you put the scope in writing, and what’s off limits?
- Who does the testing, and what are their qualifications?
- Can I see a sample report?
- Is a retest included after we fix the findings?
- Do you provide a letter we can show an insurer or a client?
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.