{"id":22916,"date":"2018-08-01T19:57:14","date_gmt":"2018-08-01T15:57:14","guid":{"rendered":"http:\/\/www.msp360.com\/blog\/?p=22916"},"modified":"2024-08-14T12:44:16","modified_gmt":"2024-08-14T08:44:16","slug":"penetration-testing-for-msps","status":"publish","type":"post","link":"https:\/\/www.msp360.com\/resources\/blog\/penetration-testing-for-msps\/","title":{"rendered":"Penetration Testing as a Service: Should MSPs Conduct Security Testing?"},"content":{"rendered":"<p>If you\u2019re a managed service provider (MSP), your clients might ask your company to conduct penetration testing. Should you be ready to do so? And why is providing penetration testing in the best interests of an MSP? Let's take a look.<br \/>\n<!--more--><\/p>\n<div class=\"table-of-content \">\n\t\t\t\t<p>Table of Contents<\/p>\n\t\t\t\t<ul><\/ul>\n\t\t\t\t<\/div>\n<h2>What is Penetration Testing?<\/h2>\n<p>Penetration testing, or pentesting for short, is when an authorized party attempts to <a href=\"https:\/\/www.msp360.com\/resources\/blog\/network-security-best-practices\/\">penetrate your client\u2019s network<\/a> as if they were a cyber attacker. That usually involves not only trying to penetrate your client\u2019s network through the internet or other networks, but also often through human beings (<a href=\"https:\/\/www.msp360.com\/resources\/blog\/social-engineering-prevention\/\">social engineering<\/a>), via web applications, and through your client\u2019s physical buildings. A thorough pentest will involve testing each of the many ways that cyber attackers could try to access the data that your client wants to protect.<\/p>\n<p>A penetration test without specific legal authorization from the people who have the right to grant it is just a cyber attack, and therefore it\u2019s probably illegal. A detailed and legally binding contract that includes the terms of the pentest is an absolute requirement. That being said, under usual circumstances most employees and contractors shouldn\u2019t be made aware that the pentesting is taking place. After all, how can you properly test for vulnerabilities if everyone knows what\u2019s coming?<\/p>\n<h2>How Does Providing Penetration Testing Benefit MSPs?<\/h2>\n<p>The most successful MSPs are also penetration testing service providers. It\u2019s your responsibility to keep your clients\u2019 networks and computers safe from cyberattacks, and you\u2019ll be a lot more effective at doing so if you know what their vulnerabilities are so you can harden against them. Also, your MSP business will benefit from having a positive reputation. A key component of building that reputation is to be better at protecting your clients from cyber attacks than your competitors.<\/p>\n<p><span class=\"further-reading \">Further reading<\/span> <a href=\"https:\/\/www.msp360.com\/resources\/blog\/providing-managed-security-services\/\">The Compact Guide To Providing Managed Security Services<\/a><\/p>\n<p>Network pentesting will help your MSP business to create an effective <a href=\"https:\/\/www.msp360.com\/resources\/blog\/msp-business-continuity-and-disaster-recovery-plan\/\">business continuity plan for your clients<\/a>. You\u2019ll have a much better idea of which ongoing services you\u2019ll need to provide for them, and you\u2019ll have verifiable data to back it up. That will help you to sell to your clients everything they need that you can offer them. Do the SIEM correlation rules need to be tweaked? Do they need more cameras to be monitored in their office?<\/p>\n<p>Your business and your client will know for sure if you do a proper penetration test. And as your client\u2019s networks change and evolve over the years, and the threat landscape does the same, you\u2019ll need to provide more network pentesting services. A successful MSP knows how to offer their clients what they need for the years ahead.<\/p>\n<h2><a name=\"types\"><\/a>Types of Pentesting Services<\/h2>\n<p>There are different types of pentesting services that you can provide to your clients. Some clients may need all of them, while others may only need some of them. Be aware of what your client requires as you compile your network pentesting checklist.<\/p>\n<div id=\"slidebox\"><a class=\"close\">\u00a0<\/a><!--HubSpot Call-to-Action Code --><span class=\"hs-cta-wrapper hs-cta-deferred\" id=\"hs-cta-wrapper-18f62c64-7b6f-413e-aef5-a7bb6cf7696e\" data-portal=\"5442029\" data-id=\"18f62c64-7b6f-413e-aef5-a7bb6cf7696e\"><span class=\"hs-cta-node hs-cta-18f62c64-7b6f-413e-aef5-a7bb6cf7696e\" id=\"hs-cta-18f62c64-7b6f-413e-aef5-a7bb6cf7696e\"><!--[if lte IE 8]><div id=\"hs-cta-ie-element\"><\/div><![endif]--><a href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/5442029\/18f62c64-7b6f-413e-aef5-a7bb6cf7696e\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"hs-cta-img\" id=\"hs-cta-img-18f62c64-7b6f-413e-aef5-a7bb6cf7696e\" style=\"border-width:0px;\" src=\"https:\/\/no-cache.hubspot.com\/cta\/default\/5442029\/18f62c64-7b6f-413e-aef5-a7bb6cf7696e.png\" alt=\"CTA\"><\/a><\/span><\/span><!-- end HubSpot Call-to-Action Code --><\/div>\n<h3>Vulnerability Scanning<\/h3>\n<p id=\"last\">Depending on the <a href=\"https:\/\/www.msp360.com\/resources\/blog\/5-tips-for-choosing-your-vertical\/\">industry that your client is in<\/a>, they may require network vulnerability scanning for the sake of regulatory compliance. Even if it\u2019s not a compliance need, vulnerability scanning can help your clients to learn how to improve their security. Security penetration testing tools include:<\/p>\n<ul>\n<li>Metasploit Pro - It is the commercial version of Rapid7\u2019s Metasploit family of network vulnerability scanning software. One of the most popular vulnerability scanners on the market, it includes features like automated scans and dynamic infiltration capabilities.<\/li>\n<li>Nessus Professional - Tenable\u2019s Nessus Professional is another popular commercial vulnerability scanning suite. It\u2019s known for its easy-to-use interface and its comprehensive detection features.<\/li>\n<\/ul>\n<h3>Infrastructure Pentesting<\/h3>\n<p>This area includes internal, external, and wireless network pentesting. The point at which you execute your pentests will affect which vulnerabilities you discover. Infrastructure pentesting can differ depending upon how you access the network, but the same tools can sometimes be used to do all three. Security penetration testing tools include:<\/p>\n<ul>\n<li>Wireshark - A network protocol analyzer that can be deployed to discover externally visible IP addresses, to conduct network device fingerprinting, and to see which TCP\/IP ports are open and how they\u2019re configured.<\/li>\n<li>Aircrack - A tool used exclusively to test wireless networks.<\/li>\n<\/ul>\n<h3>Application Pentesting<\/h3>\n<p>Many clients also need to have their applications tested for vulnerabilities. This includes both web apps and applications that run locally on operating systems. Security penetration testing tools include:<\/p>\n<ul>\n<li>W3af - A popular open-source web application vulnerability scanner written in Python. SQL injection and cross-site scripting vulnerabilities are just two of the many threats that can be detected.<\/li>\n<li>Wapiti - A web application vulnerability scanner with a \u201cblack box\u201d approach, meaning that rather than scanning web application code, it looks for scripts and forms where it can maliciously inject data.<\/li>\n<\/ul>\n<h3>User Testing (Social Engineering)<\/h3>\n<p>This is one of the main reasons why most employees shouldn\u2019t be informed when pentests are conducted. Here\u2019s your opportunity to test for social engineering vulnerabilities by trying to fool your client\u2019s staff into revealing sensitive information or providing unauthorized access. This can be done online, via email, over the phone, and also in person.<\/p>\n<p>If your client\u2019s employees regularly receive security awareness training, they will be less likely to succumb to social engineering attacks. Training should be provided often so that awareness remains fresh in their minds.<\/p>\n<p><span class=\"further-reading \">Further reading<\/span> <a href=\"https:\/\/www.msp360.com\/resources\/blog\/social-engineering-prevention\/\">How to Prevent Social Engineering<\/a><\/p>\n<h2>Pentesting Certifications<\/h2>\n<p>If your MSP\u2019s employees have certain industry certifications, it may help to assure your clients that they\u2019re qualified to perform penetration testing services. The following certifications should be seriously considered:<\/p>\n<ul>\n<li>EC-Council\u2019s Certified Ethical Hacker (CEH).<\/li>\n<li>Offensive Security Certified Professional (OSCP).<\/li>\n<li>Global Information Assurance Certification Penetration Tester (GIAC\u2019s GPEN).<\/li>\n<li>GIAC Exploit Researcher and Advanced Penetration Tester (GXPN).<\/li>\n<\/ul>\n<h2>Conclusion<\/h2>\n<p>By being ready to offer penetration testing services and products, your MSP can help to make your clients\u2019 networks as secure as they can be. You\u2019ll also have data that specifically apply to your client\u2019s network, which you can use to sell them the custom cybersecurity services that they need.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you\u2019re a managed service provider (MSP), your clients might ask your company to conduct penetration testing. Should you be ready to do so? And why is providing penetration testing in the best interests of an MSP? Let&#8217;s take a look.<\/p>\n","protected":false},"author":62,"featured_media":36292,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[877,884],"tags":[],"class_list":["post-22916","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-articles","category-msp-business-articles"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/22916","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/users\/62"}],"replies":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/comments?post=22916"}],"version-history":[{"count":3,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/22916\/revisions"}],"predecessor-version":[{"id":58352,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/22916\/revisions\/58352"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media\/36292"}],"wp:attachment":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media?parent=22916"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/categories?post=22916"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/tags?post=22916"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}