How to get the most out of your pen test remediations

Work smarter, not harder

They key to effective remediations is understanding that not all findings are created equally. Bulletproof penetration test reports include the vital ‘effort to fix’ metric and we pooled data from the thousands of penetration tests we conduct to identify quick wins.

Looking at this data we see that almost all critical and high severity flaws are low or medium effort to fix. So there’s our first clear priority target for remediation efforts. Critical and high severity flaws are as serious as their name suggests, so in this way you’ll get maximum impact for minimum effort. But after we’ve scooped up these easy wins, what comes next?

Consider the different categories

You now have a crucial decision to make: do you invest your remaining remediation budget into fixing the few number of remaining critical & high severity findings, or into a much greater number of medium severity findings? This where data needs to walk hand-in-hand with context. The different split of severity according to the category of the finding may influence how much you prioritise them. We’ve laid out the severity by category, along with some helpful narrative on why you might prioritise them – or not.

Key

Category by severity

Encryption

Only 1 in 10 findings are rated high severity, and at 47.64%, nearly half are rated medium. Encryption-based attacks are often trickier to exploit, so they’re more likely to be used by determined attackers rather than opportunistic ones. This means you need to think carefully about where your cyber threats are coming from.

Information Disclosure

Almost 7 in 10 findings are rated as low or recommendation, and less than 4% are rated critical or high. This makes Information Disclosure weaknesses generally a low priority for remediation activities.

Injection

There are about as many critical and high-rated findings as there are mediums – 32% and 37% respectively. Injection attacks can be low-effort and high reward for a hacker which makes them a good contender for remediation: you can count on these flaws regularly being tried.

Input Validation

These are an even split between medium, and low or recommendation. Medium severity issues can be chained together as part of a larger attack action, but the lack of any critical or high findings make it a difficult category to prioritise for most businesses.

Misconfiguration

Misconfiguration is another category of mostly low or medium findings, but with 1 in 6 rated high or critical it pays to look deeper into what exactly is misconfigured, and how.

Outdated Components

1 in 6 findings are rated critical, and when critical and high are combined it’s over 40%. Outdated components are used by all types of bad actors, as they typically they present very accessible flaws. This makes it a quick win for remediation, but as every security manager knows, patching brings its own set of challenges

Other

The potluck bin of the pen testing finding categories, critical and high vulnerabilities account for a little over 20% of findings. This will need a technical eye to look over the vulnerabilities and make a judgement call.

Windows Hardening

Over a quarter are rated high or critical, which is a significant percentage. However, it’s the 55% of findings being medium that’s worthy of scrutiny. The sheer ubiquity of Windows and the frequency of new exploits being discovered puts all medium-severity findings worth fixing – especially as it’s not uncommon for several medium vulnerabilities can be chained together as part of a larger attack.

Take a risk-based approach

Ultimately, it all comes down to risk management. Secretly you knew this – that’s why you’re doing a pen test in the first place. We’re always banging the drum for taking risk-based approaches to cyber security, rather than rashly implementing technical controls as a scattergun approach. If you’re taking a risk-based approach then you’ll have a clear idea of whose likely to be challenging your cyber defences, their motivations, and where your biggest weaknesses exist in your infrastructure. This data together can be leveraged to make your pen test remediations as efficient and effective as possible.