Continuous Penetration Testing

Abstract

Everything seems to move so fast. What was secure today becomes the weak link in your armor tomorrow. In January 2016, the head of the NSA ’s Tailored Access Program (TAO ), Rob Joyce, was the main event at Usenix Enigma security conference and talked about how the NSA goes about exploiting systems. He went beyond the normal stuff like basic security (which some companies still lack) or going after IT admins. He gave us a good insight into how highly funded advanced persistent threats from state nations or organized crime think. He showed that these organizations only need our defenses down for a moment. Those times when a vendor asks for a backdoor or ports to be opened, or when an administrator makes a mistake in a firewall . That’s all the attackers needs sometimes. In other words, they are watching you all the time. Nothing new there. So why do we still only test once a year?