In 2021, a new organization was targeted by ransomware every 11 seconds. In addition, 18% of companies said that cybersecurity risks will have the biggest impact on their growth through 2024, and there are now three times more networked devices on Earth than humans. Knowing this, wouldn’t it be nice to have hackers on your good side?
Penetration testing gives you exactly that. Let’s explore how in more detail.
Penetration testing is a one-time security exercise that tests the resilience of your application or network. It involves a team of white hat or ethical hackers who are hired to break into your application and find security vulnerabilities to exploit.
In this way, they do exactly what the bad actors would do when trying to access your application, except, penetration testers are ethical hackers. That means they’re ready to alert and inform you of vulnerabilities immediately. In some cases, pen testing providers may also offer you security remediation advice.
Penetration Testing as a Service (PTaaS) is an extended, more comprehensive form of pen testing that provides year-round coverage. Whereas a one-time pen test is great for providing a baseline of your security posture, PTaaS will test your application multiple times per year, plus provide security consulting and fix verification testing throughout the year as well.
Pen tests are performed by penetration testers (or pen testers, for short). Pen testers are expert security engineers who understand risks such as those detailed in the OWASP Top 10. Using a combination of manual and automated testing, they can creatively apply their unique areas of expertise to locate known vulnerabilities and often even exploit new issues.
Depending on their background, penetration testers may have various areas of expertise. For example, they may be proficient at finding one type of vulnerability (such as XSS), or may excel at certain types of penetration tests (such as mobile pen tests).
Vulnerability scanning and automated tools are very different from pen testing. Together, all have a place in a healthy security posture.
Vulnerability scanning tools, such as SAST, DAST, IAST and RAST, are quite common for organizations that want to quickly scale their security testing on the cheap. However, these tools aren’t able to dive as deep into code and can often miss critical vulnerabilities. As such, using only vulnerability scanning tools may actually be giving your organization a bit of security theater.
Today, penetration testing essentially comes in two forms: baseline penetration testing and penetration testing as a service (PTaaS).
Baseline pen testing is better suited for clients that need a one-time check on their security. Best cases for getting a baseline pen test include:
PTaaS is a more comprehensive approach to security testing, as it integrates security as part of the SDLC. As code is deployed, it is continuously tested to ensure a higher level of application security year-round. In addition, it includes consulting, more re-testing, and better access to security expertise for development teams.
Best cases for getting PTaaS include:
There are seven key stages in an effective pen test:
This stage is all about understanding the application and its unique business logic. Meetings with the client and pen test provider help ensure that all parties are well-informed about the test. The test environment must be ready at this point.
Building out a threat model is essential to understand the common use cases of the application. An effective threat model can also identify security risks in the design of the application, which may be difficult to change at a later stage. But understanding these risks early helps prepare the rest of the security plan to work around them.
The fun begins. Pen testers start diving deep into the application with a mix of manual and automated approaches.
As critical vulnerabilities are identified, the client is notified immediately. Steps to reproduce the issue are shared with the client so that their development team can begin remediation as soon as possible.
The less severe vulnerabilities found during the early stages of the pen test are exploited and escalated as much as possible without affecting the function of the application (for instance, if a pen tester is testing a vulnerability and it risks taking down the entire application, they’ll take it as far as possible without creating any actual harm). Test environments and test accounts are created to prevent any real damage and exploitation to the live application.
Upon completion, pen testers will gather all found issues, regardless of severity, into a report. A good penetration testing provider should also include steps for replicating the issue so that the client’s development team can mitigate the issue.
After the report is delivered, the client may patch several vulnerabilities. A quality pen test provider will be able to retest these known vulnerabilities shortly after to verify that they have been fixed correctly or sufficiently. In some cases, the pen tester may require that the client develops a complete fix, and in other cases a “band-aid” solution may suffice for critical issues that need deeper attention later.
When all is good to go, the pen test provider can offer a certificate to the client as proof of application security. This certification is essential when earning compliance such as SOC 2 or ISO 27500. It’s also helpful for closing enterprise deals (learn more about vendor security questionnaires here) or for startups that want to generate higher investor appeal.
We can now go over the two testing methods available. These include the following:
Manual penetration testing is when it is done by human hackers. This method needs to be handled by qualified security engineers, or pen testers, as described in the above sections.
Due to the time and effort involved in manual testing, this takes the longest and can be the most expensive of the two methods. However, with a highly qualified security engineer, this can also be the most thorough and deepest penetration test. This is especially true if you are eager to find new types of vulnerabilities or are willing to share some of your source code with your pen tester, you are better off to go with this option.
In contrast to manual testing, automated testing is the use of software tools to conduct the pen test. It is easier to scale, more affordable, and can be applied to multiple projects for less cost. So, from an economical standpoint, this is the better option.
However, automated testing may miss more critical vulnerabilities and cannot dive as deeply into your application logic as manual testing can. Thus, it is best to combine automated testing with manual testing or some other manual security exercises, such as threat modeling or secure code review.
301 Moodie Dr. Unit 108
Ottawa ON K2H 9C4