Penetration Testing in the NHS DSPT

The NHS Data Security and Protection Toolkit (DSPT) mandates robust cyber security measures to protect sensitive patient data. Penetration testing is a vital component of meeting those requirements.

Distinguishing penetration testing from vulnerability scanning

While both aim to enhance security, the two differ in approach. Vulnerability scanning identifies potential weaknesses — outdated software or missing patches — providing a checklist for remediation. Penetration testing goes further, simulating real-world attacks with a specific objective, such as gaining unauthorised access to a network share or privileged account. This proactive approach provides a more realistic assessment of an organisation's security posture.

Key requirements and scope

The DSPT emphasises the necessity of annual penetration testing, encompassing the critical aspects of an organisation's IT infrastructure. This includes:

• All web servers — identifying vulnerabilities in web applications that may expose sensitive data.
• Vulnerability scans — incorporating automated scans to detect common weaknesses.
• Default password checks — ensuring default passwords on network devices have been changed.
• Critical network structure — extending testing to server farms and other vital components.

Choosing the right approach

• Commercial — outsourcing to specialist firms offers expertise and experience, though at a higher cost.
• In-house — using internal resources can be cost-effective but requires skilled personnel and may lack objectivity.
• Partnering — collaborating with another healthcare organisation allows shared resources, but requires a similar level of expertise in both parties.

Selecting the best approach depends on the organisation's size, resources and internal capabilities.

Ensuring a high standard

To ensure the test is conducted to a high standard, organisations should seek providers with industry-recognised certifications. Attack Vector's penetration testers hold certifications such as Cyber Scheme Team Leader, demonstrating expertise and adherence to industry best practice.

Conclusion

Penetration testing is a vital component of the NHS DSPT, providing a proactive way to identify and address vulnerabilities before they can be exploited. By understanding the requirements, scoping the test effectively and choosing the right approach, NHS organisations can strengthen their security posture and protect sensitive patient information.

For an instant and customised DSPT penetration test quote, use our instant quote calculator.