Penetration testing, or pen testing as it’s often called, is one of the fundamental building blocks for a cybersecurity program. It provides vital information about an organization’s cybersecurity posture and seeks to uncover previously undiscovered vulnerabilities. It also demonstrates the impact of previously known vulnerabilities for more accurate risk assessment.

Unfortunately, according to a Ponemon survey, 89% of the organizations surveyed experienced a cyberattack in the past year and underwent roughly 43 attacks on average.

That’s a lot of pressure added to healthcare IT teams that are stretched thin. As healthcare faces new attack vectors and threat actors continue looking for new ways to profit from their endeavors, cybersecurity teams should consider shaking up their pen testing to keep pace.

The path to progress

One of the first steps in expanding a pen test scope is considering how the output from the penetration test engagement will be used.

Many healthcare organizations are moving away from an annual check-the-box approach and toward building more mature penetration programs focusing on remediation. It’s not enough to identify risk areas; healthcare organizations should also work towards resolving issues.

Proactively reducing risk will help to ensure a more robust and cost-effective cybersecurity practice. A pitfall to avoid post-pen test is not having a plan or resources ready. The hard part starts once the penetration report is delivered but being prepared can make it much easier.

Being proactive and engaged before, during, and after a pen test is a recipe for success. It’s important to prepare well in advance of a pen test engagement. Having the information and teams at the ready allows the engagement to occur with minimal impact on normal activities.

It’s also essential to focus on the scope during engagements. Pen testing can negatively impact a network and services, but with proper planning, the risk of impacts on the network decreases significantly.

When preparing for a penetration testing engagement, consider doing the following: 

  • Gather information about your network, such as where sensitive information and devices reside
  • Have an updated list of IP ranges and virtual machines on standby
  • Remain engaged and have assigned point people for the entire process

By doing these three things, you take a significant step forward in advancing your pen testing experience.

Preventing cyber attacks with proactive pen testing 

The more time the penetration tester can spend evaluating your cybersecurity posture and interacting with your team on security issues rather than admin tasks, the better.

Having an updated list of ranges and virtual machines on standby is also critical as this activity can be a significant lift.

Healthcare organizations often need to involve multiple departments as the resources often fall outside their own—a great example of why communication and assigning point people is another way to improve the experience.

Getting ready for the pen test is the first step in leveling your penetration program. To learn more about healthcare penetration programs and how to get the most out of them, watch our on-demand webinar.