The Challenge

A penetration test is where professional ‘ethical hackers’ are given permission to attempt different attacks on an organisation's systems, is a well-established method to test cyber defence capabilities and find vulnerabilities that could be exploited by a malicious hacker. Despite the wide use of pentesting, there is little in the way of guidelines as to what a good pentest should involve and how to compare different levels of service. Inconsistent terminology and levels of service are holding back the industry, leading one security provider to describe the current situation as a ‘Wild West.’

BSI wanted to know:

• Is there a need for pentesting standards in the UK?
• What related guidelines and standards exist already for pentesting in the UK and globally?
• What would such a pentesting standard include and look like?
• Would the standard be written in such a way that it could be audited against/have external certification?
• What considerations need to be taken into account when developing the standard?

Expertise Sought

• Penetration testing procedures
• Research skills
• Professional report writing

The Solution

Dr Alistair Baron and William Knowles, from Security Lancaster - Lancaster University’s EPSRC and GCHQ-approved security research centre, worked with BSI and completed background research and interviews with key stakeholders and organisations who certify pentest employees. They produced a report of their findings which highlighted a need for the cybersecurity industry to have greater 'ethical hacking' standards.

BSI highlighted three recommendations for standardisation:

• Standardised terminology for different levels of testing – enabling clients to make informed decisions and compare the market like for like
• Guidelines for reporting structure and content – offering clients greater consistency through the use of metrics and recommendations, as well as educating clients on the security threats their organisation faces
• Guidelines for the use of penetration testing as audit evidence

Cost

The total cost of the project for staff and travel expenses was £10,000, funded through the Impact Acceleration Account (IAA). The IAA is £600,000 funding from the Engineering & Physical Sciences Research Council to finance a range of activities designed to foster greater collaboration with industry and bridge the gap between the lab and the marketplace.

Impact

“By defining best practice in the area it will enable organisations purchasing pentest services to have a consistent, comparable quality of service thereby improving the security of UK organisations and providing comparable costs for services.”

“Standardisation of terminology would enable clients to compare like-for-like, which would also aid the commoditisation of penetration testing, particularly when looking to international markets,” Dr Alistair Baron, Faculty Fellow - Security Lancaster.

Benefits to the company

• Expertise in conducting the research
• A professional report containing recommendations for standardisation

Benefits to the university

• Opportunity to assist in the creation of a new industry standard
• Potential for further collaborative research in the future

Benefits to society

• The creation of a standard allows organisations to compare the market and determine the service best suited to them
• The report is freely available as an educational resource for organisations

Company Feedback

“Organisations are increasingly looking to the penetration testing industry to better understand and improve their cybersecurity. As this thought leadership report has shown, there are respected qualifications for individual penetration testers, but that there can be greater consistency of the service penetration testing firms provide.”

“Greater standardisation in this area as identified in the report should allow customers to know they are getting a consistent comparable service. In addition, it will allow providers to better demonstrate and differentiate their capabilities. BSI will use the findings of the report to reach out to the stakeholders in the penetration testing market to determine the demand for new standards,” Tim McGarr, Market Development Manager for ICT & Asset Management, Governance & Resilience at BSI.

Researcher Feedback

“Both providers and clients were found to be dissatisfied by the lack of transparency and consistency in industry offerings. Given the importance, and rapid growth, of penetration testing, resolving these needs for best-practice quickly would aid both providers and buyers,” William Knowles, Security Researcher at Security Lancaster.

Future Plans

BSI is looking to take the recommendations forward and has already conducted an initial scoping workshop. BSI has also shown interest in further collaborative research proposals based on the success of this project.

The Challenge

Xyone Cyber Security Solutions Limited provide essential support to businesses in order to secure data, assets and intellectual property against the threat of cybercrime. They wanted an intern to assist in the launch of a new service, the Cyber Advisory Service (CAS), populate the company website with frequently asked questions and information, and provide a front-line service to callers to the company.

Skills Sought

• Experience in IT
• Experience with customer service
• Knowledge of cyber security

The Solution

Jenny Lam, MSci IT for Creative Industries with Industrial Experience, was recruited through the Science and Technology Internship Programme for a twelve-week internship with Xyone Cyber Security Solutions Limited. Jenny helped to develop a new service known as the Cyber Advisory Service (CAS). She converted the idea into a workable process and oversaw its development and growth into a functioning prototype to use as a pilot. She developed the content for the online service and outlined the procedures within CAS for future staff to follow.

Outside of the CAS project she assisted the North West Cyber Security Cluster (NWCSC) with administration and communication tasks and managed social media profiles for both the cluster and CAS.

Cost

The internship was part-financed by Xyone Cyber Security Solutions Limited at £1,500+VAT, and part-financed by Santander, with a total value of £3,300. ‌

Impact

The new service provides free and impartial advice on cybersecurity issues and breaches for any small and medium enterprises within any industry across the UK.

Benefits

“Jenny’s placement allowed Xyone to develop and test a methodology and criteria for us to launch the Cyber Advisory Service, which is a new layer of client support for our company and was something we weren’t able to explore prior to Jenny’s placement due to lack of internal resource. The Cyber Advisory Service is something that is much needed by the sector and provides front-line support to businesses who fear they may be the subject of a cyber-breach, allowing the client to access a first port-of-call, and providing the partners of CAS with opportunities to offer their skills.

“Using the advanced knowledge and expertise of one of Lancaster University’s Technology students was very advantageous to us, as Jenny was able to offer her ideas and thoughts during the development process, which was really useful in getting an additional opinion.” Sarah Green, Strategic Operations Manager, Xyone Cyber Security Solutions Limited.

• Knowledge and expertise of Lancaster University Science and Technology students
• Allowed the company to develop CAS, a product which will enhance their services to their clients, and grow the company
• Saved Xyone Cyber Security Solutions Limited management time

Company Feedback

“The project helped us develop our new service – CAS – and saved us time. The internship undertaken by Jenny was a huge resource support to a small business like ours and really provided us with the opportunity to move forward, not only with the CAS project but with other areas of the business due to the additional support in place.

“We’re really so grateful to have been given the opportunity and I would highly recommend the internship programme to other small businesses. The positives we have received as a result have been tremendous, not only for us but in helping Jenny improve her skills for employment post-graduation.

“Jenny was instrumental in taking the idea of CAS and transforming it into a working, operative business process and commercial service, for which we are grateful to Jenny, and Lancaster University in helping us find the support we needed. Working with Jenny both during her internship and as a result of getting to know her personality and her skills has been very rewarding to Xyone, and hopefully Jenny too as she embarks on her first professional role within the cybersecurity sector.” Sarah Green, Strategic Operations Manager, Xyone Cyber Security Solutions Limited.

Student Feedback

“The internship was a great way for me to practice and refine my project management skills, and learn about how businesses operate in an industry different to my previous experiences. My technical knowledge also improved from gathering content for CAS, as well as speaking to technical staff about their work. Being involved in the NWCSC was a fantastic networking opportunity to meet directors from various IT companies.

“Having worked for a cyber-security company, I am now fairly certain I want to pursue a career in the cyber security industry, whereas previously I was uncertain due to a lack of experience and awareness in the area. Following on from this internship, I will be starting a placement with Xyone in January as part of my course.” Jenny Lam, MSci IT for Creative Industries with Industrial Experience, Xyone Cyber Security Solutions Limited Intern.

Future Plans

Xyone Cyber Security Solutions Limited continues to work as part of the North West Cyber Security Cluster, which is based at InfoLab21 and supported by Lancaster University. The cluster aims to raise industry standards by establishing a minimum certification level for entry to the group, with the ambition that high-quality accreditation becomes the norm for all businesses operating in the cybersecurity sector.