According to The Global State of Information Security® Survey 2015, conducted by PwC, the number of cyber-attacks reported by midsize companies with revenue between $100 million and $1 billion has increased by 64% since 2013.

Software-as-a-Service application providers, corporate networks with large customer data and virtual hosting providers have become prime targets for hackers. This has elevated the importance of IT Security in the enterprise and within various compliance and regulatory frameworks.

Key factors for high number of organizations becoming victim of cyber-attacks are

• Lack of IT security and IT management policy
• Constant use of unsecure access protocols
• Delay in fixing security flaws of operating systems and software
• Lapses in licensing for antivirus and vulnerability prevention applications
• Absence of secure coding guidelines and QA review processes

This problem can be solved through vulnerability assessment.

Vulnerability Assessment

There are two aspects to Vulnerability Assessment. The first is vulnerability assessment that includes automated scanning to determine the basic defects in the application or the network. The result of this assessment exposes vulnerabilities and flaws that may need to be addressed.

At Application Level: This involves analysis of static and dynamic code.  Static code is assessed through effective code reviews. On the other hand, dynamic code is assessed through black box approach wherein automated tools perform injections to bypass controls and crash the application.

At Network Level: Network level vulnerability scanning parses through the list of IP addresses to determine what services are defined across network and what all software applications are running to manage the network. Tests are run against listed services. One of the tests could be the login attempt with default account credentials. It is recommended that the port be closed or software be upgraded, if a probable match is found.

Penetration Testing

Penetration testing is more of a manual process which usually starts with a vulnerability scan to define vulnerabilities at the network or application level. Some flaws are difficult to detect by a scanner and in such cases penetration test needs to be performed manually.

In penetration testing, an ethical hacker makes several attempts to gain access to the network and determine which all services are running on each possible accessible host. Once he gains access, he will try to retrieve password to login to the network. In this case, the administrator will be advised to set stronger password rules. With penetration test at the application level, ethical hackers can check flaws in business logic first, that is difficult for an automated scanner to determine.

Key Advantages of Penetration Testing

• A penetration test helps in analysing effectiveness of IT security policies and expose the potential risk
• It helps detect potential risk exist in security policies; before they caused damage
• The reports generated by penetration test provides an insight on understanding existing strength and weaknesses of security infrastructure and return on investment
• Insights gained from penetration testing can be used to help train personnel to better enhance security policies and build more secure applications
• With a more realistic understanding of actual risks, management can make better decisions to make their system more secure

Penetration Testing gives an insight in the real operational context. It concentrates on the most likely exploitable issues and checks if an actual attacker could take advantage of vulnerabilities in the network or applications. Enterprises must protect the integrity of network environment, data and applications by proactively identifying vulnerabilities, timely assessment of vulnerabilities and penetration testing.

How eInfochips can help?

eInfochips Testing consultants can help you perform vulnerability assessment and penetration testing efficiently and effectively.  With hands-on experience in quality assurance, testing and mature processes, eInfochips is helping customers identify vulnerabilities and fix the same.