Pentesting for Compliance + Risk Reduction

00:04 Hello, and welcome to another episode of SYNAC Unplugged. I'm your host, SYNAC Head of Communications, Blake Thompson Heuer. And joining me today is Melissa Wooten, solutions architect here at SYNEC. Melissa, thanks for joining me to talk about compliance. Thanks, Blake, for the time. Looking forward to discussion. Yeah. So when many people think about pen testing, they think PDF report and compliance. What do you think of when you think pen testing? I think meeting those needs from a compliance standpoint is a key driver,

00:34 but the ultimate goal of leveraging penetration testing should be compliance as the starting point depending on where you're at in your security maturity, and then risk reduction, taking that data and making it actionable towards the overall risk reduction of your security program. So risk reduction is is one of those things. Okay. That sounds nice on paper, obviously important to any large enterprise, but how do you actually get there with pen testing? Metrics. Making the data actionable.

01:04 What is your vulnerability categories that keep arising? What are your mean time to remediation? What are in terms of coverage analytics are you getting in terms of your attack surface, and what type of testing is is done on it? Are you leveraging just vulnerability scanning? Are you using human intelligence applied to that? What is your methodology towards that risk reduction goal and achieving that? Now people's mind's eye image may be of pen testing. Maybe couple of testers come in periodically, schedule it on the calendar, blah blah blah.

01:34 You get the PDF. May or may not be all that actionable. Let's talk about retesting and how that fits into the risk reduction piece you mentioned. For somebody who's used to that style of pen testing I just described, which might be perfectly fine for compliance, What does retesting look like, and how does that contrast with maybe a more modern approach? So I think retesting from the standpoint of what you described, which is your initial test, thirty, sixty, ninety days post test, you get that retest. I think it puts a lot of onus on the security

02:05 providers to perform retesting and remediate everything within a condensed time frame to make sure they have everything to then their PDF translates appropriately. But if you have the ability to retest during the course of when remediation actually occurs, it does much better in terms of defining those metrics so you can evaluate the risk reduction criteria you're aiming towards while also meeting the compliance. It has a little bit more flexibility. No. That that makes a lot of sense. Now where do you see pen testing slotting into specific

02:37 compliance requirements, right, like PCI, DSS, eleven point four, GDPR, CMMC, some of these others that that mention or address pen testing. So that's a great question, and we can go into the subtle nuance of each of those compliance frameworks, and there's hundreds of them. And they call out penetration testing directly, some indirectly. But, ultimately, it's focusing on compliance being the table stake. You ought you've gotta meet compliance, but you also want to make risk reduction a priority for a good

03:07 security program. And identifying where you're at in your security maturity and understanding that compliance is a starting point and risk reduction is your ceiling. So your floor to your ceiling and how do you bridge it in between. And, hopefully, Synack can address that appropriately with our our clients and our existing clients and future clients.