Introduction:
With the cyber threat landscape being in constant evolution, especially spanning the last decade, penetration testing has become an absolute need for companies across the globe. Unlike other vulnerability detection strategies, a penetration test is a simulated cyberattack on our IT system, it uses the same techniques that an actual criminal might attempt when breaching our defenses.
Just like compliance and risk assessments, running a penetration test, at least once a year, is important to make sure we find any weaknesses in our technology and address them, before a hacker could exploit the gaps.
Our Approach:
To test that our organization's security is up to date, we perform a penetration test of our Cloud Infrastructure and our Web Applications (black box, and white box). The test is performed by a third party, a specialized Pentesting Company that bases their practices on the Mitre Attack and OWASP Top Ten frameworks.
With proper review and evaluation, pen test results will transform into action items for immediate remediation and takeaways for identifying and quantifying security risk and to revisit our overall security posture to reduce our cyber risk exposure.
As part of our post-test process we go through the results to disseminate, discuss, classify and fully understand the findings, if any, to develop a remediation plan to address them as soon as possible, and validate our implemented corrective actions with a retest within a 90 days window.
Ultimately, these tests are done for the benefit of our organization and customers, and the best reward is knowing our environment is becoming more and more secure.