You receive your report, and you see no findings. Does that mean we only ran vulnerability scans?
This question comes up frequently. We’ve talked about the differences between a real pen test and a fake one (aka vulnerability scans). But when there are no findings, it might be confusing, and you might feel like you spent a lot of money for nothing.
Network penetration tests focus on the programs that deliver content to clients. Meaning a web server, a file transfer server, or a remote management server, etc. Are these systems vulnerable? Have they been misconfigured? Is there a vulnerability in the current running version because it hasn’t been patched yet? Is the firewall configured properly to not allow traffic to internal systems, etc?
Penetration tests are meant to be proof of your mitigation efforts. The more security-conscious and security-minded you get, the tighter your network or application becomes from a security perspective. When a penetration tester finds an issue, it means you had a hole in your security posture, whether from a recent change in your design or because someone discovered and disclosed a vulnerability in a program you are using and haven’t yet patched it. When a penetration tester doesn’t identify any findings, it can be because you are all patched up, and your firewall and services are properly configured, or you aren’t providing any services.
The external networks are fairly easy to protect, as there is a boundary or a door, and you can put a bouncer (aka firewall) at the door to block people from coming in. A penetration test on external networks will often consist of creating packets of various configurations in an attempt to get passed those firewall rules. If there are no services being provided to the public (like a web server, file server, VPNs, or remote management services), then the likelihood of there being a finding is very slim. That said, a tester still has to spend time and effort performing various types of scans and tests and evaluating the responses to confirm that the firewall is configured properly and doing the job it was designed to do.
A result of no findings means they performed all the possible tests; however, your security posture is such that there were no holes in your mitigation efforts. A test result of no findings does not cheapen the report; instead, it points to proof that you are security conscious and that your methods of mitigation are effective.
