{"id":1090,"date":"2024-09-16T08:00:00","date_gmt":"2024-09-16T15:00:00","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=1090"},"modified":"2025-04-14T09:30:49","modified_gmt":"2025-04-14T16:30:49","slug":"common-security-testing-approaches-leave-gaps-heres-how-to-find-them","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/common-security-testing-approaches-leave-gaps-heres-how-to-find-them\/","title":{"rendered":"Common security testing approaches leave gaps. Here\u2019s how to find them."},"content":{"rendered":"\n

Gaps in your security testing program are likely more than simply missed assets. Infrequent testing and even low test accuracy are also gaps, and can be just as bad or worse.<\/p>\n\n\n\n

Gaps happen despite the best efforts of everyone involved. The good news is that, with some strategic adjustments, you can reduce gaps using tools you likely already have deployed. <\/p>\n\n\n\n

Visualize Your Security Testing Timeline<\/h2>\n\n\n\n

In order to make improvements you need to first understand where you are. An effective way to assess your security testing is by thinking of it as woven cloth. IP addresses and web apps are threads running horizontally. Test schedules are threads running vertically. The intersections represent critical points in your network where testing occurs for each asset.<\/p>\n\n\n\n

Figure 1 is an example, with circles, squares and triangles to represent network vulnerability scanning<\/a>, dynamic application security testing (DAST)<\/a> and penetration testing<\/a>.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Figure 1 \u2013 Ten Week Security Testing for Seven Assets<\/p>\n\n\n\n

In this example, App 2 and IP address 192.168.1.3 aren\u2019t tested at all. 192.168.1.2 is missing vulnerability scanning at week 6 and week 8. And 192.168.1.4 is tested on a much different frequency than the rest. This is the what. In order to understand the why, you will need to dig further into the business function of these assets and review test policies.<\/p>\n\n\n\n

A well-coordinated testing program resembles a tightly woven blanket, where most intersections are covered by colored dots. What you don\u2019t want is a testing program that resembles a worn-out rug; great when new, but worn thin and no longer fit for its purpose.<\/p>\n\n\n\n

Coverage, Frequency and Accuracy Gaps = Holes in the Cloth<\/h2>\n\n\n\n

Gap management is a constant juggling act. Your security teams have to adjust asset coverage, test frequency and test accuracy; it\u2019s not uncommon to address only one or two out of the three (or none).<\/p>\n\n\n\n

It\u2019s not just your company. In a 2023 survey of 304 InfoSec teams, 81% rate security testing as important<\/a> but fail to meet expectations for risk management. Gaps aren\u2019t just the result of budget or time issues. Tool complexity, lack of integration, staff skills differences, and fragmented communication are the realities of today\u2019s large IT security teams; any of which can contribute to unwanted risk. <\/p>\n\n\n\n

Benefits of Reducing Security Testing Gaps<\/h2>\n\n\n\n

By removing gaps, you can build greater efficiency into your processes, leading to several key advantages:<\/p>\n\n\n\n