Why internal audit functions should own pen testing

Given the increasing reliance on technology and the rise of cyberthreats, the internal audit function, originally rooted in financial auditing, has evolved to encompass the evaluation of cybersecurity controls. This expansion of duties has helped organizations address the growing risks associated with data breaches, cyberattacks, and the protection of sensitive information.

In the early 2000s, several high-profile corporate scandals, including Enron and WorldCom, shook investor confidence. In response, the U.S. Congress enacted the Sarbanes-Oxley Act (SOX) in 2002 to enhance corporate governance, financial reporting, and accountability. SOX also introduced requirements for internal controls, including those related to IT and cybersecurity, and created a need for cybersecurity auditors.

The role of a cybersecurity auditor involves evaluating these internal controls and the organization’s cybersecurity policies and procedures. Cybersecurity auditors assess the organization’s ability to protect sensitive data, detect and respond to cyberthreats, and comply with relevant regulations. To do so, these auditors conduct assessments, review documentation, perform technical tests, and provide recommendations to enhance the organization's cybersecurity posture. An example of a technical assessment that cybersecurity auditors perform is a pen test.

Pen testing, red teaming, and control effectiveness testing

To understand why pen testing teams should fall under the internal audit umbrella, it is helpful to understand what a pen test is and how it provides value. A pen test simulates real-world attacks, and it tests the effectiveness of an organization’s defenses, incident response capabilities, and resilience against sophisticated adversaries – played by the pen testing team.

Pen testing teams are sometimes referred to as red teams. Pen testing teams and red teams encompass distinct meanings and roles, but the terms often are used interchangeably to describe groups of security professionals that technically test an organization’s defenses. While a red team assessment is distinct from a pen test, the term “red team” generally refers to the offensive security team at large and encompasses more than just the pen testing function. By acting as an external threat actor and identifying vulnerabilities and weaknesses in an organization’s environment, systems, networks, applications, and processes, the red team can exploit these gaps to gain unauthorized access, extract sensitive information, or disrupt critical operations, thus penetrating the organization’s defenses before a real threat actor can.

With these activities also come validating the effectiveness of an organization’s security controls, testing the organization’s incident response capabilities in response to a simulated attack scenario, and enhancing the organization’s cyber resilience through proactive remediation and mitigation of vulnerabilities and risks.

To overcome the challenges associated with integrating red teams into internal audit’s cybersecurity program, organizations can take several steps.

1. First, organizations should prioritize resource allocation by investing in skilled personnel, providing adequate budgets, and acquiring the necessary tools and technologies based on the scope and depth of the required testing. As finding qualified personnel might be difficult, organizations can engage third-party specialists for the expertise required to perform the testing while internal audit assumes a leadership role.
2. Second, the differing philosophies and methodologies between internal audit and red teams need to be shared and understood by both parties. Although the specific methods of testing differ, the goals are the same, so focusing on the commonalities and being flexible with the methodologies is key. Developing and maintaining the disparate required skill sets can be achieved through training programs and professional development opportunities.
3. Finally, fostering collaboration and communication between the security team and internal audit is crucial. This collaboration can be achieved through regular meetings, sharing insights and findings, and establishing a common understanding of objectives. Transparency and streamlined reporting allow for a no-surprises environment that helps both teams make sure that identified gaps are tracked and addressed in a timely manner.

Envisioning a unified approach

The integration of pen testing teams into the internal audit function could enhance both offerings. The internal audit team could provide insights into the organization’s policies, procedures, and compliance requirements while the pen testing teams could bring a fresh perspective and specialized expertise in identifying vulnerabilities and gaps. This collaboration could yield a more comprehensive assessment of security controls and help identify previously overlooked gaps. Internal audit-driven pen testing could also provide independent oversight of security controls and additional accountability to IT teams.

Internal audit oversight of the pen testing team also could result in better integration into the risk management function. Assessment findings could be risk-ranked more accurately, the findings could be tracked more judiciously, and formal remediation plans could be drawn up with responsibilities and timelines for resolution appropriately assigned. Internal audit’s monitoring could track the progress of remediation efforts and confirm that the identified gaps are effectively addressed.

By taking these steps to make pen testing teams a function of internal audit, organizations can successfully overcome the challenges and achieve a seamless integration of the internal audit and red teams in their cybersecurity programs. Once fully integrated, organizations might find that their cybersecurity maturity improves so that they can better measure and monitor cybersecurity risks, threats, and controls and address compliance and governance more proactively.