The overall purpose of a penetration test is to assess the security level of the application. This achieves multiple goals:
The first step is the definition of the terms of the audit, its objectives, its scope, but also the choice of dates, speakers, format of deliverables and types of tests as well as the establishment of prerequisites.
In a second step, the auditors carry out their tests. If a critical vulnerability is discovered during the audit, the client's contact is notified immediately. Once the tests are complete, the auditors focus on writing the audit report. The report includes an executive summary, the list of flaws found and for each of them the description, observations and associated recommendations.
Finally, a closing meeting is set to present the results of the audit, and the deliverables are given to the sponsor. It will be possible to schedule a cross-audit afterwards to ensure that the corrections made are sufficient and not circumventable.
The penetration test verifies the following points (non-exhaustive list) on the application itself or on the infrastructure on which the application can be based (AWS S3 Bucket, EC2 instance, lambda functions, droplets):
The tests carried out take into account the cloud service mode (IAAS, PAAS, SAAS) as well as the defined scope.
The following vulnerabilities (non-exhaustive list) are potentially reported during our penetration tests:
Depending on the type of audit, SEC-IT relies on different recognized standards, among which:
Web Penetration Test
To assess the security of your web applications and APIs
Infrastructure Penetration Test
To assess the security of your IT infrastructure and network: workstations, servers, network equipment, file shares, Active Directory.
Mobile Application Penetration Test
To assess the security of your Android apps