Planning for Penetration Testing in Small & Medium Enterprises: Challenges and Best Practices

Various small and medium enterprises (SMEs) have evolved to improve their business security by protecting their assets, systems, and networks from attackers, Which concerns vulnerabilities to unsecured networks and non-compliance. Cybercriminals often consider SMEs easier targets because they may not have the same advanced defenses or security infrastructure as large enterprises. Increasing the organization's protection by penetration test technique at SMEs is a massive challenge regarding the limited resources, lack of awareness, and vendors' and business owners' specifications with the internal or external security team. To optimize the cybersecurity knowledge domain, this paper aims to investigate and contribute to the planning influence on the success of penetration testing at SMEs. This paper follows a systematic literature review to extract the descriptive outcomes and limitations from 20 accepted papers by inclusion/exclusion criteria in the period from 2015 to 2023. The primary classification schema was based on The software development life cycle (SDLC) consisting of four phases: requirements, design, coding, and system operation. The results revealed that during the requirements phase, there were investigations focused on expanding security knowledge and managing risks, particularly for smaller businesses, involving penetration testing. In the design phase, investigations centered around modeling security measures, assessing security priorities, and identifying security task patterns. During coding, the focus was on cybersecurity exercises, technological resource utilization, and implementation of social engineering tactics. Finally, investigations during the running system phase revealed the adoption of ethical hacking practices, assessment of security enhancements and risks, and management of relationships with small and medium-sized enterprises (SMEs) and third-party vendors. In conclusion, this study highlights the issues related to improving the planning for better penetration testing at SMEs.