National Television Network Centralizes Its Penetration Testing Toolkit with Core Impact
Background
Media organizations are high visibility targets to a global audience and must be vigilant in protecting their infrastructure. Like many sectors, the media industry is susceptible to threat actors and media organizations must regularly conduct their own security testing, including routine penetration tests. The average cost of a data breach to the media industry is $2.24 million, according to the Cost of a Data Breach Report, taking an average of 201 days to identify and 80 days to contain the breach within the organization. Preventing these types of data breaches by regularly testing an environment is an essential strategy for organizations to uncover security weaknesses.
The Challenge
For a well-known national television network, regularly testing the security of its environment was established as a top priority. Under the leadership of the Senior Director for Infrastructure and Security, a team of IT and security professionals at the television network developed a penetration testing program from the ground up.
The team regularly conducted a variety of tests to help assess the safety of its systems and infrastructure. However, to successfully conduct reliable tests, the security team had to rely upon a mix of multiple open source and Metasploit tools for its web application and network penetration tests. Switching between these tools was both time consuming and labor intensive for the in-house team, and required penetration testers to manually combine information and reporting.
This significant manual effort decreased the efficiency of the security team in creating a consistent, repeatable process for its testing infrastructure. What the television network security team needed was a way to centralize and automate its testing routine.
The Solution
To address the inefficient, time-consuming, and decentralized process of conducting manual tests across multiple tools, the Senior Director and his team began searching for a single rapid penetration testing solution to discover, test, and report on any security weaknesses in a fraction of the time. This would allow his team to use one tool versus the multiple open source and commercial tools they had been relying on.
The team turned to Core Impact, the leading automated penetration testing software solution from Core Security, a Fortra Company. Core Impact is a comprehensive penetration testing platform that safely and efficiently replicates attacks and uncovers security weaknesses. Organizations using Core Impact can maximize their resources with certified exploits and guided automations, providing valuable insights that will help mitigate risk and protect essential assets.
“Core Impact allows me to use one tool compared to multiple tools,” said the Senior Director for Infrastructure and Security. “There are all kinds of tools out there—whether open source or commercial. But I know that if I want to see if something is vulnerable, [Core Impact] is the tool that I want to use.”
The national television network security team had found the ideal solution to automate its testing routine and centralize its toolkit. By streamlining testing and centralizing its approach, the security team was now able to gather information, exploit systems, and generate reports all in one place. Every phase of the penetration testing process could be executed and managed from a single console. And even reports could be generated from a robust dashboard, including those on network hosts, discovered identities, and phishing simulation tests.
“I constantly use Core Impact,” continued the Senior Director. “It's the sharpest blade in my toolkit."
The Outcome
Since turning to Core Impact, the television network has reduced the complexity of its penetration testing approach, while enhancing the maturity of its in-house team. The security team is now able to collect information, exploit systems, and create valuable reports in a portion of the time because testers do not have to manually shift between each tool—giving them more time to fulfill their mission of focusing on overall organizational security. Plus relying on one commercial tool has provided added confidence that the testing is simple and reliable compared to the previous tools it was using.
“I enjoy Core Impact because it's a tool that makes a lot of things simple. I can do the attacks that I want to in an easy fashion,” continued the Senior Director. “If you take a look at Metasploit, you have to know what tools you want to use. You have to take extra steps. With Core Impact, I don't have to worry about any of that. As long as I can get an agent onto something, I can exploit it for what it is rather than setting up all this other stuff. With Metasploit, I have to create my own way of deploying an agent onto a system.”
Moving from multiple tools to a centralized toolkit has reduced the burden of the security team and allowed the organization to focus on other strategic security priorities as well. Within the television network, the security team is now conducting enhanced cybersecurity trainings and phishing campaigns for increased security awareness, is using rapid penetration testing on devices and subnets, and is leveraging Core Impact heavily for web auditing and validating elements from the web scanner.
Because of its decision to leverage Core Impact and centralize its penetration testing approach, the national television network is able to more effectively exploit security weaknesses across the organization, increase efficiencies among its security team, and ultimately take its pen testing to the next level—all with the convenience of a single platform.
I constantly use Core Impact. It's the sharpest blade in my toolkit.
See Core Impact in Action
Conduct advanced penetration tests with ease and efficiency. See what our powerful penetration testing platform can do by viewing this on-demand demo.