25 pages to know the existing and exploitable vulnerabilities on these technologies, as well as the means to counter or reduce the risks.
Before starting a penetration test (pentest), should you present your product or solution to pentesters? It all depends on your situation and on your objectives!
When we talk about cyberattacks, we often think of malicious activities coming from external attackers, while internal attacks are on the rise. In the Insider Threat Report 2019, it is reported that 59% of the companies surveyed had suffered such an attack in the past year.
Protecting yourself from the inside against these attacks is therefore just as important as defending yourself from the outside.
We are regularly conducting social engineering penetration tests for our clients.
Our pentesters (security experts) tried various techniques, scenarios and pretexts.
We have learned lessons from our experience, and our clients shared with us what they learned too. We are sharing them now with you.
The first one and the second are said to be the best allies of CISO (and in general people in charge of IT security). There are though two different tools in a security strategy. What are the different characteristics of a penetration test (pentest) and a vulnerability scanner?
It is a question that we often hear. Unfortunately Sorry, we don’t have a ready made formula to reveal. The return on investment of a pentest is complex to measure. However, we are giving you 4 keys to demonstrate the financial benefits of a penetration test. Security is not only useful to avoid potential problems, it mostly creates value to facilitate sales and strengthen the trust of your customers.
Administration interface, back-office, dashboard, admin panel… several names for the same thing: the place where organizations manage their data, supervise the activity of a web platform, handle customer requests, activate user accounts, configure articles within an e-commerce platform…
When thinking about the security of web platform, the back-office is not necessarily the priority, for several reasons:
The access to that kind of application is usually restricted, to internal services of the organization, and sometimes to third parties, supposed to be trustworthy.
Security is essential, and you agree with that. You want indeed to do
a penetration test (or pentest) on your solution soon… Here are 7 questions to help you get the most out of a penetration test.
1 – Is it Better to run te the Penetration Test on the Production or Pre-production?
Running a penetration test on your production environment has a sure advantage: the audit is conducted under actual conditions of use of your website, web application, API… with the last developments set up.
“All the success of an operation lies in its preparation”, Sun Tzu. Already true in the 6th century BC, this maxim remains true in the 21st century. And malicious attackers have well integrated it to their strategy.
Before launching their attack, attackers list all information available on the internet about their target. Digital transformation brings advantages to organisations, but it also makes a lot of information visible from the outside to who knows where to search, or even just where to look. This information helps then malicious attackers to adapt their attack to the target.
Luckily, this situation is no fatality. Each company can cartography its digital footprint, in order to then control and limit visible information. This is what a recon audit is all about.
Updated Dec 1. 2020
More than 2 years after the GDPR came into force (May 25, 2018), sanctions have been pronounced by several data protection authorities. These sanctions have important consequences, economic but above all for the reputation of the companies concerned, as they are publicly communicated.
While the essential principles of the GDPR (General Data Protection Regulation) are generally known, the main technical measures to put in place to secure a website or an information system are sometimes still not so clear. To remedy this, we detail in this article the technical security aspects of the GDPR.