According to The Global State of Information Security® Survey 2015, conducted by PwC, the number of cyber-attacks reported by midsize companies with revenue between $100 million and $1 billion has increased by 64% since 2013.
Software-as-a-Service application providers, corporate networks with large customer data and virtual hosting providers have become prime targets for hackers. This has elevated the importance of IT Security in the enterprise and within various compliance and regulatory frameworks.
This problem can be solved through vulnerability assessment.
There are two aspects to Vulnerability Assessment. The first is vulnerability assessment that includes automated scanning to determine the basic defects in the application or the network. The result of this assessment exposes vulnerabilities and flaws that may need to be addressed.
At Application Level: This involves analysis of static and dynamic code. Static code is assessed through effective code reviews. On the other hand, dynamic code is assessed through black box approach wherein automated tools perform injections to bypass controls and crash the application.
At Network Level: Network level vulnerability scanning parses through the list of IP addresses to determine what services are defined across network and what all software applications are running to manage the network. Tests are run against listed services. One of the tests could be the login attempt with default account credentials. It is recommended that the port be closed or software be upgraded, if a probable match is found.
Penetration testing is more of a manual process which usually starts with a vulnerability scan to define vulnerabilities at the network or application level. Some flaws are difficult to detect by a scanner and in such cases penetration test needs to be performed manually.
In penetration testing, an ethical hacker makes several attempts to gain access to the network and determine which all services are running on each possible accessible host. Once he gains access, he will try to retrieve password to login to the network. In this case, the administrator will be advised to set stronger password rules. With penetration test at the application level, ethical hackers can check flaws in business logic first, that is difficult for an automated scanner to determine.
Penetration Testing gives an insight in the real operational context. It concentrates on the most likely exploitable issues and checks if an actual attacker could take advantage of vulnerabilities in the network or applications. Enterprises must protect the integrity of network environment, data and applications by proactively identifying vulnerabilities, timely assessment of vulnerabilities and penetration testing.
eInfochips Testing consultants can help you perform vulnerability assessment and penetration testing efficiently and effectively. With hands-on experience in quality assurance, testing and mature processes, eInfochips is helping customers identify vulnerabilities and fix the same.
