We are regularly conducting social engineering penetration tests for our clients.
Our pentesters (security experts) tried various techniques, scenarios and pretexts.

We have learned lessons from our experience, and our clients shared with us what they learned too. We are sharing them now with you.

The first one and the second are said to be the best allies of CISO (and in general people in charge of IT security). There are though two different tools in a security strategy. What are the different characteristics of a penetration test (pentest) and a vulnerability scanner?

It is a question that we often hear. Unfortunately Sorry, we don’t have a ready made formula to reveal. The return on investment of a pentest is complex to measure. However, we are giving you 4 keys to demonstrate the financial benefits of a penetration test. Security is not only useful to avoid potential problems, it mostly creates value to facilitate sales and strengthen the trust of your customers.

Administration interface, back-office, dashboard, admin panel… several names for the same thing: the place where organizations manage their data, supervise the activity of a web platform, handle customer requests, activate user accounts, configure articles within an e-commerce platform…

When thinking about the security of web platform, the back-office is not necessarily the priority, for several reasons:
The access to that kind of application is usually restricted, to internal services of the organization, and sometimes to third parties, supposed to be trustworthy.

Security is essential, and you agree with that. You want indeed to do a penetration test (or pentest) on your solution soon… Here are 7 questions to help you get the most out of a penetration test.

1 – Is it Better to run te the Penetration Test on the Production or Pre-production?

Running a penetration test on your production environment has a sure advantage: the audit is conducted under actual conditions of use of your website, web application, API… with the last developments set up.

“All the success of an operation lies in its preparation”, Sun Tzu. Already true in the 6^th century BC, this maxim remains true in the 21^st century. And malicious attackers have well integrated it to their strategy.

Before launching their attack, attackers list all information available on the internet about their target. Digital transformation brings advantages to organisations, but it also makes a lot of information visible from the outside to who knows where to search, or even just where to look. This information helps then malicious attackers to adapt their attack to the target.

Luckily, this situation is no fatality. Each company can cartography its digital footprint, in order to then control and limit visible information. This is what a recon audit is all about.

Updated Dec 1. 2020

More than 2 years after the GDPR came into force (May 25, 2018), sanctions have been pronounced by several data protection authorities. These sanctions have important consequences, economic but above all for the reputation of the companies concerned, as they are publicly communicated.

While the essential principles of the GDPR (General Data Protection Regulation) are generally known, the main technical measures to put in place to secure a website or an information system are sometimes still not so clear. To remedy this, we detail in this article the technical security aspects of the GDPR.

After a security audit, you have been notified flaws. Critical, important, medium: do you know how this is assessed? We describe here our methodology, based on the OWASP* one, to estimate the severity of the risks associated with the vulnerability.

Phishing evolved a lot. Whereas fraudulent email was before easily detected by its obvious spelling mistakes and its exaggerated request or threats (immediate bank transfer, account completely deleted…), it uses nowadays codes of trusted institutions. Phishing email involves besides personalized demand or known contacts of the attacked person (a manager for example), which makes it hard to detect.

Phishing aims an interaction with a tricked email. It is the most used method in social engineering, a branch of cybercrime.
Social engineering targets human behaviour. Its purpose is to lead a user to reveal confidential information and to realise harmful actions for themselves or for an organisation the user belongs to. You can raise awareness of your team about this risk by conducting a social engineering audit. 

We will see in this article how to avoid different phishing strategies, which can be tricky even for experienced and attentive users.