Checking the lock on your front door once a year is not enough............

When trying to explain the difference between intrusive, yet highly important, Penetration Testing and regular scanning services to colleagues, friends or even family I find the best way to do so is by using a 'House' analogy!

Having a yearly Penetration Test is highly important should you rely on critical internal & external facing assets to ensure you identify all areas of vulnerability and then mitigate the relevant threats. You most definitely need to ensure the resilience of your security controls and identify all the ways that an attacker might gain unauthorised access to these key assets. This, in my example, is the checking of your lock(s) to stop any unauthorised access to your 'house'. 

Doing this (PT) more than once a year though is costly, but does that mean you shouldn't regularly check the rest of your 'house' to ensure vulnerabilities are not exposed to any risk? 

If you have expensive items in your lounge, or Kitchen, or even cash stowed away under a bed (this is not me by the way for those wondering) then you complete checks of your 'house' to makesure everything is as it should be, and this is what regular scanning is on your own external and internal infrastructure. 

You need to asses your key assets for potential vulnerabilities and where required put in place effective means to manage and monitor the vulnerability risks associated with external and internet facing infrastructure on a more regular basis than standard infrastructure penetration testing.

A Managed Security Service (regular managed scanning if you wish) simply supplements the comprehensive penetration testing you are already receiving, and would consist of daily infrastructure delta scanning coupled with monthly, quarterly or adhoc automated vulnerability assessments. A regular status report would be provided with all identified vulnerabilities assigned a risk rating of high, medium or low depending on the level of assessed threat.

Regular scanning just keeps your 'house' in order in between your more intrusive yearly Pen Tests!