Speed Without Shortcuts: Getting a Fast Pen Test and Fast Cyber Essentials Before the Deadline

Deadlines always seem to arrive before the security paperwork. A customer wants their test proof by the end of the month, a tender closes next week and there’s a board meeting coming up with absolutely no-one having done the basics. In those situations a fast pen test and a fast Cyber Essentials cert can be the difference between a successful outcome and a complete failure. Speed is only of any use if the work is actually good. This article looks at how you can move quickly without compromising on quality.

When a tight deadline is real

The vast majority of requests fall into a very few well-worn categories. A bigger client will add security evidence to their onboarding checklist. A public sector tender will require certification prior to submission. An insurer will ask for evidence of controls at renewal. A new product launch will require a clean certificate from an external tester.

None of these scenarios is in any way unusual and none of them should in fact be a cause for alarm. They do however reward the organisation that actually understands what the two pieces of evidence are and how they fit together.

Two documents, two purposes

Cyber Essentials is a UK government backed scheme which looks at whether an organisation has the basic protections in place. A penetration test is very different. It’s a practical attempt to break in and see what happens. One verifies that the basics are there, the other tests whether they actually work.

What fast Cyber Essentials really involves

Cyber Essentials is based on five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Certification is achieved by completing a self assessment questionnaire on how the controls are in place, which is then reviewed by an assessor.

Fast Cyber Essentials is absolutely achievable as the process is very well defined. The delays are almost always down to the preparation rather than the assessment itself. An organisation that already knows how many devices it has, who has admin rights and when the last patches were applied can complete the questionnaire in a very short time. An organisation that has to go out and find that information will lose days.

A practical tip: get the facts first. Make a list of the laptops, phones, servers and cloud services. Note which accounts have admin privileges. Check that the OS and apps in use are still receiving updates from the vendor. Devices running on software that is no longer supported are by far the most common issue and they take significantly longer to resolve than simply answering the question.

What a fast pen test looks like in practice

A fast pen test doesn’t mean a rushed one. It means efficient scoping, quick scheduling and a reporting process that doesn’t drag. The testers still need time to properly look at the systems so the saving is generally going to be on the admin side rather than the testing itself.

Several things speed the process up:

• A clear, agreed scope settled within a day or two, rather than weeks of back-and-forth.
• Access sorted in advance, whether that means test accounts, VPN credentials or network details.
• A named contact on the client side who can answer questions quickly.
• Quick decisions on timing, particularly for systems that cannot be disturbed during working hours.

When those are in place a fast pen test can go from first call to final report in a lot less time than the average procurement cycle would suggest.

Which comes first?

For most organisations Cyber Essentials should be the first thing to do. The certification process does a very good job of tidying up the basics and as a result the subsequent penetration test is far less likely to find the easy wins (e.g. missing updates, weak admin settings). The testers then have their skills properly applied to the more subtle issues.

That said the order can be reversed if the deadline requires it. If the customer specifically wants the test evidence and the certification can come after then there’s absolutely no rule against doing them in parallel. Doing both at the same time is ideal for small teams as the same prep notes can be used for both.

Avoiding the traps of urgency

Urgency can lead to bad decisions. A few warnings are worth keeping.

Don’t just go for the provider on the basis of the speed they promise. Find out what’s actually in the offer and who will be doing the work. A quote that’s too good to be true may be based on an automated scan with a human name just tacked on to the report.

Don’t guess at the answers to the Cyber Essentials questionnaire. The assessors will check the answers against the rules and incorrect answers will result in failures and resubmissions which take far longer than a carefully completed questionnaire would have done.

Don’t skip the follow up. A quick pen test that generates a long list of findings is only of any use if those findings are then remediated. Allocate time in the calendar for remediation prior to the test commencing.

Using both results well

Once you’ve got the certificate and the report, get them out and about. Pass the cert number on to customers if they ask for it. Provide a high level summary of the pen test findings to the procurement team (without going into any of the detail that would be considered sensitive). The full report is of course only for those who need to see it.

Treat the results as a starting point as well. The certification is valid for 12 months so a renewal date must go in the diary. Testing should be repeated annually or sooner if there have been any significant changes to the network, the website or the cloud configuration.

A sensible timetable

Where there’s a hard deadline in play the basic sequence would be: spend the first few days gathering the device lists, account details and network diagrams. Submit the Cyber Essentials questionnaire as soon as the answers have been checked. Book the penetration test as early as you can (tester availability is often the bottleneck) and book it whilst the cert is still under review.

Whatever the order, keep the lines of communication open. A quick answer to a provider’s query is worth far more than any rush fee.

The practical takeaway

Speed and quality are absolutely compatible if you do the preparation first. A fast pen test works because the scope is defined and the access is in place. Fast Cyber Essentials works because you already have the facts about the devices and the accounts. The organisations that treat both of those as proper projects with a plan rather than as emergencies are the ones that get it done quicker and with far fewer surprises.