Administration interface, back-office, dashboard, admin panel… several names for the same thing: the place where organizations manage their data, supervise the activity of a web platform, handle customer requests, activate user accounts, configure articles within an e-commerce platform…

When thinking about the security of web platform, the back-office is not necessarily the priority, for several reasons:
The access to that kind of application is usually restricted, to internal services of the organization, and sometimes to third parties, supposed to be trustworthy.

Security is essential, and you agree with that. You want indeed to do a penetration test (or pentest) on your solution soon… Here are 7 questions to help you get the most out of a penetration test.

1 – Is it Better to run te the Penetration Test on the Production or Pre-production?

Running a penetration test on your production environment has a sure advantage: the audit is conducted under actual conditions of use of your website, web application, API… with the last developments set up.

“All the success of an operation lies in its preparation”, Sun Tzu. Already true in the 6^th century BC, this maxim remains true in the 21^st century. And malicious attackers have well integrated it to their strategy.

Before launching their attack, attackers list all information available on the internet about their target. Digital transformation brings advantages to organisations, but it also makes a lot of information visible from the outside to who knows where to search, or even just where to look. This information helps then malicious attackers to adapt their attack to the target.

Luckily, this situation is no fatality. Each company can cartography its digital footprint, in order to then control and limit visible information. This is what a recon audit is all about.

Updated Dec 1. 2020

More than 2 years after the GDPR came into force (May 25, 2018), sanctions have been pronounced by several data protection authorities. These sanctions have important consequences, economic but above all for the reputation of the companies concerned, as they are publicly communicated.

While the essential principles of the GDPR (General Data Protection Regulation) are generally known, the main technical measures to put in place to secure a website or an information system are sometimes still not so clear. To remedy this, we detail in this article the technical security aspects of the GDPR.

After a security audit, you have been notified flaws. Critical, important, medium: do you know how this is assessed? We describe here our methodology, based on the OWASP* one, to estimate the severity of the risks associated with the vulnerability.

Phishing evolved a lot. Whereas fraudulent email was before easily detected by its obvious spelling mistakes and its exaggerated request or threats (immediate bank transfer, account completely deleted…), it uses nowadays codes of trusted institutions. Phishing email involves besides personalized demand or known contacts of the attacked person (a manager for example), which makes it hard to detect.

Phishing aims an interaction with a tricked email. It is the most used method in social engineering, a branch of cybercrime.
Social engineering targets human behaviour. Its purpose is to lead a user to reveal confidential information and to realise harmful actions for themselves or for an organisation the user belongs to. You can raise awareness of your team about this risk by conducting a social engineering audit. 

We will see in this article how to avoid different phishing strategies, which can be tricky even for experienced and attentive users.

[Article updated on November 8, 2022]

Have you used google dorks today? If you have searched for a word within quotes or combined two terms with AND, then the answer is yes.

Googles dorks are advanced search operators that allow you to better target your research.

They can even enable to identify vulnerabilities and strengthen your security, let’s see how.

Do you usually conduct application testing before releasing? In this article you will find out why conducting outsourced penetration testing can strongly strengthen your application security level and your brand image.

The need for web application firewalls

If you don’t perfectly see the difference between a firewall and a web application firewall, I recommend you read this article we published a few weeks ago, explaining the differences: Traditional Firewalls or Web Application Firewalls?
The reality of threats makes web application firewalls a real complementary approach to secure coding practices and security testing.
Global protection against known (and unknown) attacks, virtual patching and security events reporting are real added values.

Traditional firewalls protect IT environments against external attacks, by allowing and blocking connections to certain areas.

These firewalls control incoming and outgoing network traffic, based on a set of rules.

Here is a basic example:
Let’s suppose your company has a web server inside its infrastructure. In order for the web server to be reachable from outside your company, some rules will have to be established to authorize web traffic to and from that server.
Some “ports” will be open, on a given IP address (the one of your server).
Your company can choose to allow web traffic only, or allow other traffic according to its needs.