Tier3's Web Application Penetration Testing and Security Assessment will comprehensively appraise the security of an application. The tests are carried out from both the authenticated and unauthenticated perspective and will offer an evaluation of the sites security posture from both valid users who aim to escalate access privileges, and unauthorised users.
Web app penetration tests test will generally include:
- Testing user authentication to verify that accounts cannot compromise data;
- Assessing the web applications for flaws and vulnerabilities, such as XSS (cross-site scripting) or SQL Injection;
- Confirming the secure configuration of web browsers and identifying features that can cause vulnerabilities; and
- Safeguarding web server security and database server security.
Tier3 penetration testers follow an established methodology based primarily upon the OWASP (Open Web Application Security Project) Top 10 Application Security Risks. This approach will emulate the techniques of an attacker using many of the same readily available tools.
- Scoping - Before testing, our account management team will discuss your assessment requirements for your websites or applications to define the scope of the test.
- Reconnaissance - During this step, our team maps the web application – using manual and automated means – to ensure that all pages in scope are identified for closer analysis.
- Assessment - Using the information identified in the initial phase, we test the application for potential vulnerabilities. This will provide your organisation with the ability to produce an accurate threat and risk assessment.
- Reporting - Tier3 Penetration tester will fully analyse the test results, and a full report will be prepared for the customer that will set out the scope of the test and the methodology used.
- Re-test - We can provide access to our testers and the raw test data to support and expedite remediation. We can also retest your systems so that you can be sure all the issues have been successfully resolved.
The service provides the client with a report that is comprehensive, clear and concise. The report is designed to provide information for a diverse audience of readers .
The report delivers :
Executive Summary – The opening section of the report provides, in plain English a executive summary overview of the entire assessment including recommendations to improve the security posture of the in scope environment.
Graphical Summary – Key findings are ranked, split into three impact categories and positioned in a graphical table according to the relative risk or likelihood of exploit.
Security Evaluation by Category – The evaluation ratings compare information gathered during the course of the engagement to “best in class” criteria for security standards. An evaluation of “Excellent”, “Satisfactory”, “Fair” or “Improvement Required” is provided. Each category includes a best practice statement, evaluation result and recommendation to achieve best practice.
Vulnerability Analysis – The vulnerability analysis section provides a detailed description of each discovered flaw including any necessary technical information and corrective recommendations.
Exploitation Probability – Each listed vulnerability is assigned a “Probability” rating based upon how likely the vulnerability is to be exploited.
• Test delivered under industry best practice methodologies by qualified consultants
• Determines the security level of your externally facing infrastructure
• Provides clear instruction on how to further secure your externally facing infrastructure
Find out about complete range of Penetration Testing Services in Pakistan as provided by Tier3.
