Pentesting

The purpose of performing a Pentest is to test a specific part of systems, to gain insight into security problems and to efficiently remedy them with the information obtained. Pentesting is also performed to see if an application's security meets the standard. In addition, some applications also require periodic pentesting like for example a DigiD investigation.

A pentest is suitable for any organization that wants to measure the security level of their websites, ICT infrastructures, API links, mobile apps and (web) applications.

Where a pentest tests a specific part of the ICT infrastructure within organizations, the demand for a company-wide security test is increasing. A scenario-based pentest has a larger (organization-wide) scope and different goals, namely: how resilient and/or mature is the organization to defend itself against certain threats. And preferably a test that approaches the reality of a cyber attack as closely as possible, so that the result of the test optimizes the security for this scenario. To meet this demand, Securify has developed the Scenario Based Pentest. Since companies do not need to have a SOC and a blue team as with a Red Teaming exercise, a Scenario Based Pentest is suitable for most organizations.

A pentest looks at a specific part of the systems. A Red Teaming targets specific targets through a series of attacks based on a chosen miter att&ck® threat modeling. Securify simulates a real APT (Advanced Persistent Attack: constant, hidden and advanced hacking techniques) with the aim of, for example, exfiltrating data (leaking data to the outside world) or simulating a ransomware attack. Red Teaming is usually performed at a company or organization if they themselves have a Blue (defensive) Team and thus a Security Operations Center. The difference between a Scenario Based Pentest and a Red Teaming is that a Scenario Based Pentest examines part of a complete attack. So you do not go through a complete attack from start to finish (in-through-out), but limit yourself to, for example, a part where you already have access to the internal network and you assume that a laptop has already been taken over or you are investigating how the escalation is proceeding if you run a Phishingmail campaign.

A pentest is performed by a pentester with all the knowledge required to perform the test. With a pentest, an extensive report is drawn up about how and where vulnerabilities were found by testing them and then efficiently resolving them. Security can be optimized by following the identified recommendations. A vulnerability scan is an automated quick check by means of a software program without further steps and/or indepth about the detected vulnerabilities.

A pentest ensures that a specific part of the system is tested for security vulnerabilities and the information obtained can be used to fix the security problems. There are three types of pentests: black box, gray box and white box. Code review is applied to software to see where there are security flaws and provides a clear and deep code analysis to get to the root of the problem. In principle, this comes very close to a white box pentest. The recommendation at Code Review is to do this in the development phase of the software to save time and repair costs.

Securify combines a pentest with a code review and sees this as an added value for customers, because it offers more depth to the research (added value). Other security parties usually limit themselves to performing a black or gray box pentest. Securify also looks under the hood (in the code) of your application in order to identify vulnerabilities faster/better and therefore make a better recommendation to the customer.

An automated Pentest is an automated quick check by means of a software program without further steps and/or depth about the detected vulnerabilities.

A pentest takes an average of 1-4 weeks.

In addition to the standard Pentest that can be performed according to various methods such as Black Box, Gray Box and White Box, Securify also offers the Scenario Based Pentest. In a Scenario Based Pentest, a security assessment is performed at a company or organization by simulating an advanced attack based on a specific scenario, for example a ransomware attack. The aim of the test is to assess an organization's existing security level in order to arm itself against realistic cyber attacks. The security level is determined by three aspects: prevention, detection and response.

You choose a type of Pentest in consultation with a cybersecurity specialist, such as Securify. They look at which Pentest best suits your company or organization. It is recommended to choose a Pentest that not only detects vulnerabilities in systems, but where recommendations can be given in particular. And by following these recommendations you can optimize the security of systems (or have them optimized). There are three types of pentests: black box, gray box and white box. With a White Box test, the pentester receives all possible information about the system to be tested in advance. This is the most thorough Pentest and the most efficient way to perform the test. Securify prefers this variant because we can offer the most added value.

We have three different methods for performing a Pentest in websites, ICT infrastructures, API links, mobile apps and (web) applications: Black box, Gray box and White box. The Black Box Pentest is a real cyber attack as cybercriminals would perform. In this form, the pentester does not receive any information in advance about the application, system or IT environment to be tested. The level of knowledge of our pentest team here is comparable to that of a malicious hacker. The Gray Box Pentest is a so-called intermediate form, in which the pentester receives limited information in advance. The simulation level of the pentester here is comparable to that of a resentful (former) employee or a customer. With the White Box Pentest (Crystal Box) all possible information is obtained in advance by the client about the system to be tested. This is the most thorough pentest and the most efficient way to conduct the test. Since our pentesters have access to the source code, they can more quickly get to the root causes of vulnerabilities and make targeted recommendations.

There are currently no courses where you can study for a pentest. But a bachelor's degree in Cyber Security or a master's degree in Information Security Technology is a good starting point. There are also a number of certifications for pentesting and information security. Experience shows that most pentesters started in the profession because they are curious by nature and do a lot of research and figuring things out for themselves (intrinsic motivation). There are online free trainings that people can follow to get the “feel” (HTB/tryhackme). And then gain experience at specialized Cybersecurity companies, such as Securify.