Cybercrime is set to cost companies more than $6 trillion per year by 2021. If you don’t want your small business to be included in this figure, it’s essential to invest in cybersecurity.

Bad actors are always looking for new ways to overcome or evade cybersecurity software and get access to your devices and networks. As such, it’s essential for endpoint protection services – those that secure your computers, laptops, mobile phones, tablets, etc - to be regularly tested, so that vulnerabilities can be highlighted and fixed before they can be exploited by perpetrators.

With cybercriminals constantly creating new ways to attack businesses, cybersecurity is a fast-moving industry. This means that live scans and checks of computers/devices using network security tools double as a test for the protective software itself. Testing your network can highlight any threats that your business may face – and show you the steps you need to take to protect yourself further. By collating this data from businesses and individuals across the world, cybersecurity companies can build a picture of which weaknesses are small-scale or one-offs, and which are large-scale problems that need high-priority investigation.  

So, how does cybersecurity software stay up to date? And what tests can you do to ensure that protection for your business will work? And how does this prevent cyberattacks on small businesses?

This article explains three tests that help to safeguard your business and improve the endpoint security software’s defensive capabilities.

1. Vulnerability scanners

As you’d expect from the name, vulnerability scanners assess the computers in your business network for weaknesses: entry points that can be exploited by cybercriminals hoping to gain access to your data.  

Vulnerability scanners compare the services and applications running on your system against a database of known weaknesses in the service including ports and scripts that could potentially be exploited by hackers looking for points of entry.

Vulnerability scanners act like hackers to investigate these potential vulnerabilities. The scans can be run in two different ways. The first is unauthenticated, which would present your system to the scanner as an outsider would see it, without special access permissions. Second, is an authenticated scan. In this instance, the scan would have the same access as a typical user on the system.

The aim of a vulnerability scan is to inspect your systems from every perspective, by combining the two scans, you can build a strong sense of the state of your cybersecurity setup from an internal and external perspective, identify weaknesses, and improve your security to better protect against these risks.

2. Penetration testing

Also known as ‘pen testing’, this is the process whereby cybersecurity experts purposefully ‘attack’ a network to review how secure it is. It simulates a real attack, but in a controlled way. As such, the term ‘ethical hacking’ is sometimes applied to penetration testing.

There is often confusion between vulnerability scans and penetration tests - and, as a small business owner, you may not have a dedicated IT manager on hand to guide you through the jargon. While vulnerability scans highlight any weaknesses in your business network, pen tests take this a step further by determining what kind of malicious activity is possible if those weaknesses are exploited. In other words, how your weaknesses can be hacked.

These tests can be conducted from inside or outside the network, depending on what the test is trying to discover. For example, a pen test could be conducted to test how your customer database could be accessed, or how easy it would be to access your business network from a certain computer (or endpoint.)

While some elements of pen tests are automated, they are usually planned, conducted, and evaluated by cybersecurity consultants. They are a more advanced test than vulnerability scans and can vary in complexity depending on the business being assessed.

Regardless of your organization’s size, you should have a pen test conducted at least once a year. It is also important to conduct new tests if you have major changes to your business network, for example, if you add new office locations or change operating systems.

3. Program update checks

Software that isn’t regularly updated offers bad actors a better chance of getting into your business, as it won’t have the latest updates and patches. Developers make every effort to discover and fix any vulnerabilities before a computer program or application is released, but as new security vulnerabilities are exposed, they release “patches” that fix the problem. Patches are additional or replacement coding for computer programs and are used to fix a vulnerability or strengthen existing security.

In many cases, users can easily approve and install these manually or schedule them to install automatically.

However, even applications that are built and released by trusted, well-known software brands can have flaws. For example, perpetrators famously exploited the EternalBlue vulnerability in Windows software to carry out the massive 2017 WannaCry ransomware attack. If businesses had patched their Windows systems, WannaCry wouldn't have been so successful.

It is therefore essential to regularly update your operating systems, third-party applications, and drivers. Your operating system will have an option to check for updates in the settings menu. This will compare what’s installed on the computer with the latest upgrades online and tell you what needs updating. Patch management systems are designed to identify and install new patches as soon as they become available.

Some program settings may allow automatic software updates, and others will ask your permission. All users should regularly check to ensure that all available updates are accepted (or scheduled for a convenient time) on every device they are responsible for.

While these tests are essential for helping to protect your business, they are most effective when used together as part of a layered security package. Learn about Avast Business products.