Penetration Testing Lübeck

A penetration test, or "pentest" for short, is a security check that emulates an attack by a malicious party on a network or application to identify security vulnerabilities. This test is coordinated in advance and conducted in such a way that no system is damaged. At the end of the test, you will receive a report that includes the problems and vulnerabilities found, along with suggestions on how to fix them.

At the beginning of the process, we try to familiarize ourselves with your company and the scope of work so that we are able to provide an accurate quote. We gather this information on purpose so that we don't come back and ask for more testing time (and additional costs). The more information you are willing to share with us, the better we can provide an estimate.

However, some customers want a black box approach, where only a limited amount of information is provided, to simulate a real attack and the response to it. In this case, we still need to capture the size/complexity, that is required for testing, and therefore have some fundamental questions about scope.

In a white-box test, the pentester receives all relevant information about the target system(s). The advantage is that this approach saves time - and thus costs. It is also generally true that white-box tests are more effective in improving the security of IT systems and should usually be preferred.
Generally speaking, black-box testing can be a suitable means of uncovering security issues against a specification (e.g., a Web API interface), but is very poorly suited to identifying flaws within specific components. In the latter case, white-box testing should be the preferred means.

One question that is not asked often enough is how much of the testing is automated and how much is manual. Automated tools, especially at the beginning of a project, can save save a pentester a lot of time and their use also depends on the project. However, experience shows that about 90-95% of the pentest is "manual work".

This is not to say that automated vulnerability scanners do not add value; Vulnerability scans are quick and easy tools that should be used on a regular basis to should be used to identify missing patches or outdated software in larger environments.

The terms "penetration tester" (also "pentester" for short), "white hat hacker" and "ethical hacker" are often used interchangeably. The terms "ethical hacker" and "white hat hacker" cover all hacking activity aimed at improving IT security. What they all have in common is that activities that are illegal or do not comply with the Code of Ethics are refrained from.
Formally, a penetration test is only an "ethical hack" with very clearly agreed rules, a formal procedure as well as a defined goal.

The scope of a penetration test should always be jointly adapted to the specifics of the company as well as the system to be tested.

In the case of a Web application, the scope often consists of the server and operational landscape as well as the user interfaces and APIs. Often, there are enterprise applications that have been specifically was written and that you want to have looked at.

Other considerations also play a role in a network pentest. In particular, the scope you choose should include mission-critical systems that would Could compromise security in the event of a compromise, e.g. because they store sensitive data, such as user information, passwords or customer data.