“Most of the tactics to compromise those credentials didn’t require Common Vulnerabilities and Exposures,” Antani said of a red team test performed by his company. Twenty percent of the initial credentials the company compromised were domain administrator credentials, “which means we got keys to the kingdom almost immediately.”
Thinking like these cybercriminals is the first step to protecting your environment, he said. “In cybersecurity, the only perspective that matters is the attacker’s perspective. What does your environment look like through the eyes of the attacker, and how do you use that perspective to fix problems that matter?”
READ MORE: Find out the top five vulnerabilities uncovered during penetration testing.
What’s New for Penetration Testing?
Because the cybercriminals are armed with AI, health systems need solutions of the same caliber to defend their environments.
“We need to use AI and automation first, fast and for defense,” Bickley said.
“The whole goal here is that offense drives defense,” Antani noted. “Offense helps make sure you’re facing problems that matter.”
AI helps organizations defend their environments at scale, matching the speed and efficiencies of threat actors, even when healthcare IT departments are comparatively stretched thin.
The penetration testing process previously took a long time: IT needed to first get the expenditure approved, then work with a team of security experts who poked and prodded the hospital’s network defenses.
When organizations used Horizon3.ai’s NodeZero platform, Antani noticed “a shift toward continuously assessing your environment, fixing problems that actually mattered and quickly running a retest to verify that you’re good to go.”
DIVE DEEPER: Optimize cyberdefense with managed security services.
However, finding the problems that actually mattered and — more specifically — “deciding what not to fix” were always challenges, Antani said.
AI offers solutions for that too.
Determining a pen test’s value by its ability to find problems is a legacy way of thinking, Antani pointed out. “The goal of the pen test is to fix problems that matter,” he said.
An automated pen test can make these identifications as part of its assessment. “Now, suddenly, what’s exploitable is what you’re going to go off and prioritize,” Antani said.
