Breach and Attack Simulation and penetration testing are both approaches to security validation.

Penetration testing, which is most commonly performed by human ethical hackers, is focused on discovering and exploiting vulnerabilities in systems, networks and applications. BAS, on the other hand, is fully automated and used to simulate specific threats such as ransomware and test the effectiveness of security controls against them.

Picus Security’s approach to attack simulation means that simulating threats is practically risk-free.

Typically, simulations rely on agents deployed on specific endpoints in your environment. They allow for a wide range of attack techniques to be simulated. The attack simulations are completely safe and do not target and alter production systems.

Security control validation describes the process of testing and optimizing cyber security controls. With security control validation, security teams can measure the effectiveness of prevention and detection controls and understand if they provide coverage against the latest cyber threats.  Proactive identification of threat coverage and visibility gaps enables security teams to address exposures before attackers can exploit them.

Ever-evolving attack techniques and constant changes in IT environments mean security control validation is essential to quantify cyber risk and optimize threat readiness. Only by validating controls consistently can security teams keep pace with the latest threats and discover gaps before attackers do.

In order to keep pace with the evolving threat landscape and changes in IT, security control validation should be performed regularly. At a minimum, validation should be performed weekly as well as in response to new emerging threats and configuration changes to prevention and detection security controls.

Traditional security assessments such as vulnerability scanning and penetration testing are focused on the discovery of vulnerabilities and misconfigurations in networks, systems and applications. The purpose of security control validation assessments is not to Identify vulnerabilities but instead validate the effectiveness of security controls to prevent and detect cyber attacks.

To comply with the latest information and data security regulations and standards, organizations must proactively test the effectiveness of security controls and processes. In Europe, The General Data Protection Regulation (GDPR) states that organizations should have a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures. ISO-27001, the PCI DSS, and frameworks such as NIST 800-53 also have similar requirements.

To reduce cyber risk, security teams should validate as many network and endpoint security controls as possible. Many organizations start by validating the ability of prevention controls such as firewalls, intrusion prevention systems, and antivirus to block network infiltration and email threats. Validation of EDR and SIEM provides additional assurance by assessing detection capabilities, such as whether detection rules reliably generate alerts when specific adversary behaviors are identified.