With new threats discovered every week, trying to stay on top of your security can be challenging. For enterprise organisations and larger web applications, running regular tests can be a great way to maintain high standards of cyber security. 

Firstly, what is a Penetration test?

You can think of a pentest as a controlled cyberattack launched on your system’s network, to try and find any unknown vulnerabilities. The test is ultimately designed to discover security flaws before a hacker does, which helps you reduce your attack surface and identify risks before they become problems. This type of testing goes beyond automated security scanning and can involve in-depth scans and even social engineering attempts.

We work with industry-leading pentesting specialists to ensure you get the maximum benefit from your test, which will offer:

• In-depth testing of all apps and infrastructure – depending on your requirements, every component can be tested, including network, systems, apps, and even people (which is known as social engineering). 
• Detailed remediation plan and strategy – The reports provide the vulnerabilities found in your systems and the steps you need to take to fix them.

Understanding the different types of Penetration tests

There are different types of penetration tests, each designed to target and test different aspects of your business security. We’ll briefly run through which tests are available and what type of vulnerability it uncovers.

Infrastructure | Attack Surface

An attack on a business’s infrastructure is the most common type of Penetration test. It can focus on current patch levels, improper configurations, flaws in the design, and the effectiveness of security controls.

Infrastructure | Authenticated

An authenticated infrastructure test simulates an attack by a hacker who has breached your perimeter or has phished user credentials. This test includes all testing activity from the Attack Surface testing, plus an additional focus on password cracking, system and network privileges.

Application | Attack Surface

Here the functionality, process flow, and security controls of applications are tested. These tests specifically address access control, session/configuration management, error handling, data protection, and input. 

Application | Authenticated

This is designed to imitate a hacker who has phished valid user credentials or infiltrated your business perimeter defences. Including the Attack Surface testing, it also tests breaches only possible with valid credentials. 

It’s ideal for organisations that need a detailed test to model an attack by a more determined cyber-criminal.

Targeted | Social engineering 

This is an exhaustive penetration test, modelling an intensive attack against your organisation. It covers the human element of security, where testers will try to access sensitive information by manipulating human psychology. 

This usually involves a lot of techniques, such as targeting employees over the internet with phishing emails, phone calls, as well as exploiting pitfalls in operational procedures, and trying to compromise physical security. 

It’s designed for organisations and businesses whose security demands a thorough and exhaustive test, identifies all areas of cyber security weaknesses.

Get started with a Penetration test today

By choosing the right scope and the right type of test, you can easily identify and fix your security vulnerabilities, visit our page for more information – Penetration Testing – ProStack.

Get in touch today if you’re interested in arranging a pentest, or have any other questions about website & application security.