To Pentest or not to Pentest: is this really the question?

I wrote before about Pentesting in the article “What is Pentesting, Vulnerability Scanning, which one do you need?” .

If you’re a company having web services of any kind or a kind of backend, you are asking yourself if you should only do pentesting or make things right and do the entire risk assessment and threat modeling exercise.

Pentesting is like an insurance showing to the external world that your product will not be hacked easily once it is live.

The common understanding these days, is that pentesting identifies such errors and helps the company to fix them. It might find really big issues, which denote normally a severe lack of knowledge (aka incompetence) regarding programming  of web services.

Most of the time it isn’t the case.  But what is sure is that most of the time though, it produces so many false positives that it masks any medium or small issue that might become a problem in the future.

Again, I am not saying that you should not do pentesting. I am saying that it should be done at a later point in time, with another priority.

 

I can think from different points of view:

  • from the perspective of the company producing the software, it is better to do all the other steps we discussed about before, fix what is to be fixed and only at the end do a pentest just to verify that nothing was forgotten.

  • from the perspective of the developer, you can’t easily accept that your product might have security issues. So, why messing around something that anyway “is not broken” and “can’t be broken” ?

  • from the perspective of the end-customer: pentesting is a checkmark, a guarantee that something was done to insure that their data is safe from hackers.

 

At the end of the day, the company must make sure that everyone is happy, while thinking for the long term:

  • Do you want to invest time and resources regularly in doing pentesting after each major change?
    OR
  • Do you want to invest time and resources in making sure that the developers know what to look for and know how to think so that the product they build is secure by default, design and deployment?
    In this case pentesting would just be the checkmark that confirms what you knew already.

Tough decision, I know. 🙂

 

Hint: 

Go for the second. It will let you sleep better at night and will make your company better prepared for future attacks.


© Copyright 2016 Sorin Mustaca, All rights Reserved. Written For: Sorin Mustaca on Cybersecurity


Check www.endpoint-cybersecurity.com for seeing the consulting services we offer.

Visit www.itsecuritynews.info for latest security news in English
Besuchen Sie de.itsecuritynews.info für IT Sicherheits News auf Deutsch

Related Posts

Avira Techblog: Would you buy security software advertised in a spam?

We received a spam email which advertises protection against Internet threats. The email comes from “Top Anti Virus Software” , an email address from a domain in India. There are only two links in the email, both pointing to the same URL from India which was used in the From field. At that address, of course, is […]

Avira has a Risk Level

http://techblog.avira.com/risk-level/en/ Avira Risk Level definitions There is an average level computed for the last 30 days for both malware and phishing. The alert level is computed like this: 1 Normal activity – less than -50 percent 2 Increased activity – between -50 and -25 percent 3 Suspicious activity – between -25 and 25 percent 4 […]