By now, I think everyone has heard the phrase “moving to the cloud” enough to make their head spin. And it’s true, organizations are steadily moving to the cloud because of the many benefits this model of operation offers. According to Forbes in 2017, “hybrid cloud adoption grew 3x in the last year, increasing from […]
Before we start any engagement, we like to go over a document that lists all of the Rules of Engagement (ROE) for the upcoming penetration test. We cover things like making sure you have approval from your cloud provider, when status updates will be sent to the client, and how time sensitive and critical issues […]
A web application penetration test takes a look at the security of external or internal application for your organization. This type of testing goes above and beyond standard network-level penetration testing, focusing on the both the unauthenticated and authenticated portions of a website. But why do web application penetration testing? What threats are you addressing for […]
If there is one type of assessment that is not like the others, it is the physical penetration test. A physical penetration tests assesses the risk to your organization of an attacker physically breaking in. This blog will explore the physical penetration test, what questions it answers, what type of clients typically seek physical penetration […]
The term “Rules of Engagement” sounds intimidating the first time you hear it, but don’t be alarmed, it is meant to protect both you as the client and your penetration testers. The Rules of Engagement, or ROE, are meant to list out the specifics of your penetration testing project to ensure that both the client […]
Technically, no, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) does not specifically require penetration testing. But stick with me, because there are some important nuances to make note of here. While the act never specifically calls out vulnerability scans or penetration testing, there are a number of industry experts and standards organizations […]
We often get asked, “what is the typical timeline for a penetration test?” The projected schedule can often dictate the business decision around which penetration testing firm to ultimately go with. When you’re under a tight deadline, it’s helpful to get a better idea of what to expect when contracting for a penetration test. While […]
Among the security testing that PCI DSS v3.2 requires is external penetration testing. External penetration testing is becoming a regular part of security practitioner’s vocabularies, with seemingly every security standard requiring it and any mature security program identifying its importance. The requirements surrounding a PCI external penetration test have some specific nuances that are worth […]
Unfortunately the age old adage “you get what you pay for” has never been more true than in the penetration testing industry. We often hear from potential clients that are seeking a new penetration testing partner because they had previously gone with the cheapest quote and are now “paying the price” (pun intended). A response we […]
We often get asked what is the easiest way to prepare in order to improve the results of your penetration test. Whether it be to ensure your regulatory compliance, provide a clean penetration test report to a potential customer, or just to better your overall security posture, having a penetration test with fewer critical findings […]
