3 min read

What is penetration testing?

Jazmine West November 16, 2020

Healthcare cybersecurity news

Hand selecting security lock icon surrounded by biometric and security feature icons

Digital security concept with hand interacting with icons for fingerprint authentication, encryption, protection, links, search, and settings

Healthcare continues to be the most targeted industry for cyberattacks, and that number continues to trend upwards in the midst of the coronavirus pandemic ( Health IT Security ). SEE ALSO: Healthcare Data Breaches – A Haunting Reality Many healthcare organizations are beginning to take cybersecurity much more seriously. Unfortunately, it still may not be enough. SEE ALSO: Universal Health Services Is the Target of One of the Largest Medical Cyberattacks in History Another tactic that providers can take to secure their networks is to conduct penetration testing.

Definition

Penetration testing (also shortened as pen testing) is a preventative security measure to expose vulnerabilities in computer networks and data by simulating a cyberattack. A company requests ethical hackers or cybersecurity experts to perform a planned “attack” in order to identify any weak points in its security system. Upon conclusion, a business is armed with useful information to strengthen its defenses against cybercriminals.

Is pen testing critical for healthcare?

Absolutely! According to Health IT Security , protected health information (PHI) is the most targeted type of data by cybercriminals because it often contains valuable data such as bank account information. It is often leveraged in ransomware attacks. SEE ALSO: Cybercriminals are Adapting Ransomware Strategies to Exploit the Current Crisis Penetration tests can help you achieve HIPAA compliance by identifying any points where unauthorized parties could access data. In fact, pen testing covers the technical evaluation requirement for HIPAA administrative safeguards .

How are pen tests conducted?

The first step before running a pen test is to establish a goal for the test. Of course, the primary goal is to expose security vulnerabilities, but more specific objectives may exist depending on the organization’s needs ( Core Security ). For example, a hospital may want to test if certain databases or data points can be targeted. Once a goal is established, a tester may be granted either full or limited access to system information. The amount of data a tester is given largely depends on the organization’s goal. White box testing , also known as internal testing, is when a tester acts as an employee or authorized user to perform a pen test. This supplies the tester with detail and insight into weak points and vulnerabilities. A white box approach can also reveal how employees may intentionally or unintentionally exploit PHI and other sensitive data. SEE ALSO: How to Ensure Your Employees Aren’t a Threat to HIPAA Compliance Black box testing (external testing) gives as little information as possible to most closely resemble a real cyberattack. The tester performs the pen test from an outsider’s perspective. Gray box testing falls somewhere between the white box and black box approaches. This can be useful if an organization wants to measure or control the level of permission users have.

What are the different types of tests?

A variety of pen tests exist to discover weak points with different techniques on various platforms. PurpleSec recognizes 6 types of pen tests:

Network Services: This test is the most common and identifies vulnerabilities in the network infrastructure (servers, firewalls, routers, etc).
Web Application: A more complex test, experts evaluate web apps, browsers, and associated software and plugins.
Client-Side: This test involves client-facing programs and software including email clients, web browsers, and programs such as Microsoft Office or Adobe Photoshop.
Wireless: Devices that are connected to a common network (phones, laptops, printers, etc) are targeted to examine any connection vulnerabilities.
Social Engineering: This test highlights any phishing and other fraudulent/trust-based cyberattacks.
Physical Penetration Testing: Often overlooked, a tester attempts to gain physical entry into a data center such as a server room or file storage.

How often should organizations conduct pen tests?

Redscan recommends testing annually at a minimum, but there are other situations that warrant a test, including:

Infrastructural changes
Mergers & acquisitions
Launching new products or services
Maintaining/updating a system for compliance

Between tests, it’s still necessary that your organization remains protected. Inbound email security is a critical way to defend against phishing attacks and other malicious emails. Paubox Email Suite offers HIPAA compliant email by default—no extra steps or addons for the sender or receiver. It also includes two-factor authentication to ensure the identity of authorized users. Our Plus and Premium plan levels block all types of phishing emails. This is critical to protect your system from ransomware or malware that can stealthily steal or spy on your organization’s data. Additionally, Paubox Email Suite Premium includes data loss prevention (DLP) to keep employees from sending sensitive data to unauthorized parties (intentionally or otherwise). Strong email security is necessary to ensure your healthcare organization is not vulnerable to cybercriminals and reduces the need for frequent penetration tests (which can be very expensive.) Make sure your company and patient data are protected with Paubox.

Try Paubox Email Suite Premium for FREE today.

Start for free