Page 109 - Cyber Defense eMagazine for September 2020

One solution to this problem is to merge person and machine, using scanners to augment pen tests and
provide coverage during periods between manual testing. Doing so can help overcome the innate
limitations of both approaches. However, the aforementioned BAS platforms also provide an elegant
solution to this longstanding problem.

That's because BAS platforms offer the best elements of both approaches: The precision and depth of a
manual pen test combined with the continuous coverage of a vulnerability scanner. By constantly probing
for new threats (based on the world's most comprehensive threat directory, MITRE ATT&CK), and
simulating the most likely techniques and attack paths used by adversaries, an advanced BAS platform
acts a permanent, hyper-vigilant red team -- one that never needs a day off or takes a break.

The Takeaway

Manual and automated testing differ in many key respects, yet they both can work together effectively to
ensure that an organization's security posture is sufficiently robust. By incorporating advanced
vulnerability scanning -- and cutting-edge new solutions such as BAS platforms -- organizations no longer
have to make compromises. Instead of opting for deep but infrequent coverage (manual tests) or shallow
but continuous coverage (conventional automated scanning), it's possible to have the best of both worlds
-- and enjoy the peace of mind afforded by thorough and ongoing security testing.

About the Author

Tamir Shriki is a Customer Operations Manager at XM Cyber. Tamir
has held various positions in the cybersecurity industry and
managed major customer escalations. He has a strong background
in network security, virtualization, AV, IPS, sandboxing, BYOD,
mobile access technologies, and encrypted communication
protocols.

Cyber Defense eMagazine – September 2020 Edition 109
Copyright © 2020, Cyber Defense Magazine. All rights reserved worldwide.