NCSC Shares Tips on How to Make a Pen Tester’s Job Harder

The NCSC summarises penetration testers' advice that organisations should adopt secure-by-design development (threat modelling, phishing-resistant MFA, avoid hard-coded credentials, input validation), enforce strong network segmentation including IT/OT separation and privileged access workstations, and collect quality logs with exercised incident response processes to make compromises harder and improve detection and remediation.