5 Best Practices For Choosing a Penetration Testing Company

Penetration testing has become more important than ever. Businesses who take pre-emptive measures to keep their sensitive data and servers secure find pen testing a great option to ensure the integrity of their system’s security, to meet compliance requirements, and decrease overall cyber security risks.

Here are five best practices for hiring the right penetration testing company:

Identify your pen testing needs

Before you start looking for penetration testing service providers, it’s important to establish your objectives and identify the type of pen testing services you need.

You should decide whether you need to hire pen test services for mobile apps, web applications, network, or perhaps conduct comprehensive pen test services for every platform.

This is important because each pen test services require specialised knowledge, tools, and expertise, which will also dictate the quality of results and costs of the services.

Assess the expertise of professionals

Once you identify your needs, it’s time to start looking for companies that offer pen testing services.

While you should opt for reputable pen testing companies, it’s important to learn about pen testers who will work on your project.

You should ideally look for professionals with experience and knowledge of the testing process.

Confidentiality and data security

During the pen testing process, the service provider has access to the confidential data of your company, and there’s no other way around it.

Therefore, it’s critical that you hire a company that can demonstrate that they will keep your data safe and secure during the engagement.

You certainly don’t want to entrust a third-party that cannot guarantee the confidentiality and security of the sensitive information of your business.

Ask for references

It’s always a good practice to ask for a couple of references before hiring a pen testing service provider. Ask for references of clients with similar size business and scope of the project.

This way, you can get valuable insights pertinent to their quality of service, professionalism, and turnaround times.

Moreover, this will also help you to determine whether the service provider will be able to fulfil the specific pen testing needs of your business.

Validate the pen testing methodology and process

Clarify the pen testing methodologies with your service provider to ensure that they follow industry-recognised pen testing practices.

You should ask for steps involved in the process, tools used, and the strategy that will be used for evaluation, among other important processes.

Typically, the company will offer a statement of work describing these details. This way, you will be able to ascertain the quality of work and level of thoroughness during the testing process.

When choosing a penetration testing company, these pointers will help you make the right call.

For sophisticated and trustworthy penetration testing services, get in touch with Lean Security at 61 (2) 8078 6952.

Our extensive range of cyber security services can help you identify all sorts of vulnerabilities present in your system and take timely measures to keep your sensitive information protected.

Effects of Malware on Websites [Infographics]

Is Your “Secure” Password Policy Actually Secur

While more and more of our private communication, health records and financial transactions are stored online, a strong password policy is our front line of defence to protect information. This kind of information, if in the wrong hands, can pose serious security risks and it’s more important now than ever for administrators to enforce a strong password policy.

23.2 million people were hacked worldwide who used the password: “123456”. This reiterates the fact that not only do users need to come up with stronger passwords, but administrators must also educate users in how to make these strong passwords. Here’s how to go about it.

Understand What A Secure Password Policy Is

A password policy is a set of rules that guides users to create strong and dependable passwords that will help improve computer security. While some password policies are simply guidelines that a user has to follow and not abide by, other times the user must adhere to the strict requirements of the password policy.

While most people are aware of the security risks of keeping a simple password, it can be troublesome for them if the password policies are extremely strict and unfamiliar. Most users get frustrated keeping up with the regulations that they create a password that just barely meets the requirements.

Enforce Using A Strong Password

The stronger the password, the higher the level of security you have. There are certain rules a password policy must have in order to generate strong passwords. While these rules are not set in stone, they are good in providing direction for the users to create strong passwords that can’t be easily hacked.

The kind of rules that every strong password policy must have include: a decent length, minimum of 8 characters long. No personal information at all, and it should be unique from your previous passwords. It should also include uppercase and lowercase letters, numbers and symbols.  

Pass-Phrase Instead of Pass-word

Instead of using a password, users can implement the use of a pass-phrase. With growth in computing power and technology, cracking a word, even if it’s littered with numbers and symbols is not that difficult for a computer than can run 300,000 possible password variations in a second.

A pass-phrase however, something like “I-am-going-to-church-on-Sunday”, would have over one sextillion possible variations. Even a computer running 300,000 possible variations per second would require years to crack the pass-phrase. Pass-phrases are longer and much harder to guess even for computers and are even easy to remember for the average person.

Having trouble forming a “secure” password policy? Well, let us at Lean Security provide you with the assistance you need! Protect your vital information from hackers and scammers by indulging in our penetration testing services.

We also cover mobile application penetration tests to ensure that the safety of your information is guaranteed! Contact us today for more details.

Me Confused: What’s the Difference Between Vulnerability Assessment and Pen Testing

We hear you; vulnerability assessment and pen testing sound erringly similar. To be honest, the two security assessment methodologies even confuse established vendors and experienced cybersecurity professionals. But the fact is vulnerability assessment and pen testing are very different from each other, and today in this post, we’ll be explaining this difference.   

The Difference Between Vulnerability Assessment and Pen Testing

Vulnerability assessment is testing a system, network, app or other computing resource for “known” vulnerabilities and finding out which vulnerabilities apply to the resource.

You might ask:

What are known vulnerabilities?

Known vulnerabilities are those vulnerabilities that are already out there in the domain of public knowledge. They might be listed in the National Vulnerability Database (NVD), reported on the internet, stored in open databases, or available on the dark web.

So during vulnerability assessment, your testing team will basically have a list of known vulnerabilities, and they’ll check your system for each of them to find out if they apply to your case.

Vulnerability assessment is conducted using automated scanning tools.  

Pen testing, on the other hand, involves testing a system, network, app or other computing resource for both known and unknown vulnerabilities and exploiting those vulnerabilities to evaluate the severity of the risk at hand.

During pen testing, the testing team executes a simulated attack on your resource that mimics the strategies and actions of hackers.

It must be mentioned here that vulnerabilities that don’t lead to anywhere valuable are typically ignored in a pen test.

So, for example, let’s say you have a landing page that has minimal user engagement. A pen test would not focus on that page because the testers would know that the page is of little value. In contrast a vulnerability assessment would treat that page with equal significance as any high converting landing page.

Pen testing is conducted using both automated tools and manual penetration.  

To summarize the difference between vulnerability and pen testing:

A vulnerability assessment helps you identify if the doors in your office building are unlocked. A pen test helps you identify which doors in your office building are unlocked and what criminals would do once they are inside your office building.   

We hope now you are clear about the difference between vulnerability assessment and pen testing.  

For further reading: 3 Major Pen Testing Techniques

A Business Owner’s Basic Guide to Pen Testing

Pen testing, short for penetration testing, has never been more important than it is today. With ransomware, phishing, DDoS attacks and countless other tactics used by increasingly sophisticated cybercriminals, the best defence starts with knowing your strengths and weaknesses.

What is pen testing?

Pen testing is the practice of evaluating a system’s security infrastructure to find potential vulnerabilities and understand how the system could be attacked. This information is then used to suggest countermeasures that can be taken to reduce the risk of security breaches and improve security maturity.

Pen testing is conducted by hiring cybersecurity professionals. The security professionals are authorized by the company to conduct a simulated attack on its behalf to test its computer system, network, software application or other computing resource for potential loopholes.

Since the goal of a pen test is to help the company strengthen its security infrastructure, and the findings of the test are strictly used for that purpose and that purpose only, pen testers are also commonly referred to as ethical or white hat hackers.

The pen testing process

A typical pen testing process involves five steps:

· In the first step, pen testers gather information about the computing resource that needs to be tested. This information is gathered by using different tools.

· In the second step, the gathered information is studied by the testing team to identify potential vulnerabilities in the system.

· In the third step, an attack is designed to exploit the identified vulnerabilities.

· In the fourth step, the testing team evaluates the significance of the data at risk and prioritizes the vulnerabilities accordingly.

· In the fifth and last step, pen testers report on their findings and recommend ways on how the vulnerabilities can be eliminated.

Wrapping up

Sun Tzu wrote in the Art of War: “If you’re ignorant of your enemy and yourself, you’re certain to be in peril.”

Pen testing offers intelligence on how your enemy (a potential attacker) might exploit your system resources and provides insight into your strengths and weaknesses, so that you can better prepare against future cyber attacks. 

Looking for a comprehensive pen testing service for your business?

Lean Security can help.

We are expert pen testers, headquartered in the beautiful state of New South Wales. We specialize in mobile application pen tests, web application pen tests, web service pen tests, IoT pen tests, external network pen tests and source code pen tests. Contact us today to discuss your pen testing needs.