Penetration Testing
Penetration tests are used to uncover security vulnerabilities in the client's IT systems.
„A penetration test is a controlled attempt to penetrate computer systems or networks using the means and techniques of real attacks in order to identify vulnerabilities.“
This definition, borrowed from the German Federal Office for Information Security (BSI), describes the main focus of a penetration test, namely the application of techniques used by real attackers. The simulated or actual attacks are intended to uncover vulnerabilities in the IT systems, infrastructure or organizational and personnel security.
A security gap enables a malicious intruder to read or change information without authorization or to impair the availability of the systems. A penetration test can be used to check the extent to which the security of IT systems is endangered by threats from hackers, crackers, etc. or whether IT security is currently guaranteed by the security measures in place.
The quality and benefit of a penetration test is essentially determined by the extent to which it is tailored to the client's individual situation, i.e. how much time and resources are used to investigate vulnerabilities affecting the specific IT infrastructure and how creative the approach is. We therefore not only use the standard vulnerability scanners, hacker tools and exploits available on the Internet and in stores to carry out penetration tests, but also software developed in-house.
There are no laws that oblige companies or authorities to have penetration tests carried out. However, there are binding regulations regarding the security of data relevant to tax and commercial law and the handling of personal data. According to prevailing opinion, compliance with legal requirements cannot be guaranteed simply by establishing standard measures such as security concepts, virus scanners or firewall systems. Only by carrying out regular penetration tests can you obtain a permanent overview of the risk to your systems.
Goals
The objective of a penetration test should be defined as precisely as possible in advance. Most penetration tests are commissioned with the aim of increasing the security of technical systems. These tests are usually limited to the IT systems and applications, i.e. firewall, web server, web applications, etc. The organizational procedures and the employees are not part of the test. This method is typical if, for example, a specific test is to be carried out to determine whether access from the Internet to internal systems by unauthorized third parties is possible.
However, a penetration test can also be used to specifically identify vulnerabilities. This objective is often a part of the introduction of new products or technologies in an organization. For example, many acceptance contracts for web applications developed on behalf of companies provide for a penetration test of the application to proof its security.
Another objective can be to have the security of the infrastructure checked by a third party, for example in the run-up to ISO 27001 certification. However, it must be noted that a penetration test only ever represents a selective assessment of security at one point in time. New security vulnerabilities are discovered and attacks developed practically every hour. However, regular penetration tests can be a way of proving the high security of IT systems and data.
In addition to the technical infrastructure, organizational or personnel security can also be tested. This includes the appropriate response to social engineering attacks and phishing emails or the verification of escalation procedures. In Germany, in many cases, the verification of personnel security is subject to co-determination. A works or staff council should therefore be involved in such plans at an early stage in order to coordinate the specific aproach, e.g. with regard to the identifiability of individual employees.
Penetration Testing Variants
Depending on the objective, different variants are possible for carrying out a penetration test.
Infrastructure Testing
Infrastructure penetration tests are used to gain an overview of all existing risks and vulnerabilities. In a penetration test from the Internet, we check firewall systems, VPN access, mail servers and the entire network structure accessible from the Internet. In an internal penetration test, our primary targets are domain controllers, file servers and internal web servers as well as peripheral devices such as switches, routers, UPSs and network printers.
Web Application Testing
Web applications and web APIs are now an integral part of most business processes. The potential damage in the event of a compromise is correspondingly high. In our penetration tests for web applications, we test input options in web applications as well as web-based APIs. Of course, we test the current OWASP Top 10 list of vulnerabilities in web applications, but also all potential vulnerabilities of the current version of the OWASP Web Application Testing Guide (WSTG), depending on the depth of testing.
Mobile App Testing
Applications on tablets and smartphones are becoming increasingly important. Accordingly, the requirements for information security and data protection are also increasing for mobile apps. We check your mobile apps for risks and vulnerabilities. In addition to checking the mobile app itself and the business logic of the application, the security of the backend systems and web service APIs as well as the security of the container infrastructure also play a major role.
Individual Testing
Individual tests are perfect for newly installed systems or applications that need to be verified and approved. Let us discuss your specific wishes and requirements together.
Breach and Attack Simulation (BAS)
With a breach and attack simulation instead of a penetration test, we can also test the effectiveness and efficiency of your endpoint detection and response solution, your security information and event management and your security operations center. Based on various use cases, we check, for example, whether internal clients can establish a connection to command and control servers on the Internet, whether the leakage of confidential data is prevented and whether external attacks, e.g. against web applications, or internal attacks, e.g. lateral movement, are detected by the SIEM or SOC.
Our Service
We check the security of your IT systems, your web applications and your infrastructure.
All results of the penetration test will be presented in a report and a detailed presentation. It includes a presentation of the attack schemes used, all security vulnerabilities discovered (if any) and an assessment of the risk and contains tips and suggestions for improving the security of the tested systems. All knowledge gained and the results of the penetration test are of course treated confidentially and are destroyed by us after delivery. As malfunctions of the systems under attack cannot always be ruled out, we are also happy to carry out penetration tests outside your business hours or at weekends.
Also attend our hacking courses to better understand the risks or to plan and carry out attacks yourself.