Vulnerability Assessment (VA) and Penetration Tests (PT) are risk assessment techniques used for identifying known and unknown vulnerabilities in systems and networks. They form an integral part of any compliance process of various standards and auditing procedures including SOC 2, PCI DSS, and ISO 27001, etc. Both VA & PT assessments provide validation for an organization’s strong cyber security program. SOC 2, PCI DSS and ISO 27001 are standards that relate to the organizations processes, policies and technologies.
Moreover, many organizations have started considering and prioritizing the security programs of an organization when selecting a vendor. This has pushed service providers to achieve SOC2 compliance demonstrate that they have implemented adequate levels of security controls. So, for the purpose of SOC2 Compliance, vulnerability assessment and penetration tests are crucial. Explaining the significance of these assessments in SOC2 Audit we have shared details as to why VAPT matters.
Vulnerability Assessment VS Penetration Testing
Vulnerability assessment and penetration test are two assessments crucial for cybersecurity. Both the technical assessments are often confused as the same services, but they are different and play a key role in protecting the IT infrastructure. While vulnerability assessment is an advanced and highly automated test that helps identify vulnerabilities, penetration test intends to exploit the weakness in systems and determine the severity of risk exposure.
Both tests can together enhance the IT Infrastructure security and help establish a strong security program. While vulnerability scans provide an insight into your network security, penetration tests involve performing a detailed examination of the infrastructure to discover weak areas and the possibility of compromise.
So, depending on the cybersecurity program objective and/or the requirements of the compliance standard, organizations must accordingly perform either of the two or both tests. Based on the requirement either discover vulnerabilities, build strong security programs, or simply evaluate the effectiveness of their existing security controls, your organization can opt for a Vulnerability Assessment or a Pen Test for their IT Infrastructure.
Why does the Vulnerability Assessment and Penetration test Matter?
Vulnerability Assessment and Penetration Testing (VAPT) provides a comprehensive review of the application, systems, and networks evaluated. VAPT gives the organization a detailed view of the threat exposure, allowing businesses to improve their cyber security program and protect their IT Infrastructure.
The assessment helps the IT team focus on addressing weak areas and fixing the vulnerabilities discovered in the systems. The assessment discovers coding errors, misconfigurations, and such other flaws in the system and network that impacts or threaten the security of the IT infrastructure. Overall, it secures the infrastructure from malicious attacks.
Does SOC2 Audit require vulnerability assessment and penetration test?
SOC2 Attestation criteria do not explicitly mandate the need for Vulnerability Assessment and Penetration Test in the AICPA Trust Service Principles. It does not list out controls that an organization should have in place to meet SOC 2 compliance. Instead, it outlines a list of requirements for which various controls can be designed to meet the requirements.
SOC2 Attestation report as we call it is not a certification, but an auditor’s opinion on the effectiveness of controls designed at the service organizations. SOC 2 specifies criteria for which adequate controls can be designed. So, this clearly leaves room for interpretation on the design of controls to be established to meet the criteria.
Depending on the understanding of the SOC 2 requirements by the CPA audit firm, they can mandate the need for vulnerability scans and penetration tests for the service provider’s design of controls to meet the Trust Services Criteria. It all depends on whether the auditor deems the controls as adequate for the SOC2 requirements. However, in general, organizations must consider performing such assessments as this is the industry best practice for evaluating the security of the infrastructure. SOC 2 certification is critical to the organization and having the right assessment process in place is essentiaḷ.
SOC 2 framework has three requirements under the Trust Service Principles that Service Organizations must meet to achieve SOC 2 Audit
CC7.1 – To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities. (Source- us.aicpa.org)
Here the points of focus, specifically related to all engagements using the Trust Services Criteria highlight important characteristics relating to these criteria. This includes Conducting Vulnerability Scans which means-
“The entity conducts vulnerability scans designed to identify potential vulnerabilities or misconfigurations on a periodic basis and after any significant change in the environment and takes action to remediate identified deficiencies on a timely basis.” (Source- us.aicpa.org)
So, taking into consideration the risk associated with patch management and misconfiguration, organizations must engage in vulnerability and penetration tests. Besides, SOC2 Auditors will need evidence that your risk management processes include regular vulnerability and penetration scans
CC4.1 – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. (Source- us.aicpa.org)
Here the point of focus specified in the COSO framework includes the management using different types of ongoing and separate evaluations, including penetration testing, independent certifications made against established specifications (for example, ISO certifications), and internal audit assessments.
CC4.2 – COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate. (Source- us.aicpa.org)
Here the point of focus, specified in the COSO framework highlights the need for the management and the board of directors to, as deemed appropriate, assess results of ongoing and separate evaluations including penetration testing, to track the vulnerabilities and remediate them in a timely manner.
Performing periodic vulnerability scans and penetration tests on an organization’s network and application are highly recommended. This provides the organization an insight into the critical infrastructure of any organization. Both the security assessment works in conjunction to build a strong security program. More than often organizations perform multiple assessments for discovering security flaws and fixing the gaps. The goal is to achieve and continue maintaining effective compliance with the requirements of the security standard.
Conclusion
While vulnerability scans are mandatory to meet CC7.1 SOC2 requirements, penetration tests are not mandatory to meet CC4.1 SOC2 requirements for as so long as there is an alternate security assessment performed for achieving SOC 2 Attestation. However, we do believe that both penetration tests and vulnerability assessment together have a significant role to play in ensuring maximum security of the data and infrastructure. The assessments are the most efficient ways to validate and mitigate cyber risk. These assessments are the industry’s best risk assessment techniques that help achieve compliance with various regulatory and cyber security standards.
About the Author:
Narendra Sahoo (PCI QSA, PCI QPA, CISSP, CISA, and CRISC) is the Founder and Director of VISTA InfoSec, a global Information Security Consulting firm based in the US, Singapore & India. Mr. Sahoo has more than 25 years of experience in the IT Industry, with expertise in Information Risk Consulting, Assessment, and Compliance services.
VISTA InfoSec specializes in Information Security audit, consulting, and certification services which include GDPR, HIPAA, CCPA, NESA, MAS-TRM, PCI DSS Compliance and Audit, PCI PIN, SOC2, PDPA, and PDPB, to name a few. Since 1994, VISTA InfoSec has worked with organizations across the globe to address the Regulatory and Information Security challenges in their industry. VISTA InfoSec has been instrumental in helping top multinational companies achieve compliance and secure their IT infrastructure.
