Web Application Security Assessment

Penetration Testing - Information Sheet

Web Application Penetration Testing & Security Assessment

Tier3's Web Application Penetration Testing and Security Assessment will comprehensively appraise the security of an application. The tests are carried out from both the authenticated and unauthenticated perspective and will offer an evaluation of the sites security posture from both valid users who aim to escalate access privileges, and unauthorised users.

Web app penetration tests test will generally include:

  • Testing user authentication to verify that accounts cannot compromise data;
  • Assessing the web applications for flaws and vulnerabilities, such as XSS (cross-site scripting) or SQL Injection;
  • Confirming the secure configuration of web browsers and identifying features that can cause vulnerabilities; and
  • Safeguarding web server security and database server security.
Breaches that start with website and application attacks account for 47% of the breach costs, making application attacks the costliest.

Tier3 penetration testers follow an established methodology based primarily upon the OWASP (Open Web Application Security Project) Top 10 Application Security Risks. This approach will emulate the techniques of an attacker using many of the same readily available tools.

  1. Scoping - Before testing, our account management team will discuss your assessment requirements for your websites or applications to define the scope of the test.
  2. Reconnaissance - During this step, our team maps the web application – using manual and automated means – to ensure that all pages in scope are identified for closer analysis.
  3. Assessment - Using the information identified in the initial phase, we test the application for potential vulnerabilities. This will provide your organisation with the ability to produce an accurate threat and risk assessment.
  4. Reporting - Tier3 Penetration tester will fully analyse the test results, and a full report will be prepared for the customer that will set out the scope of the test and the methodology used.
  5. Re-test - We can provide access to our testers and the raw test data to support and expedite remediation. We can also retest your systems so that you can be sure all the issues have been successfully resolved.
The service provides the client with a report that is comprehensive, clear and concise. The report is designed to provide information for a diverse audience of readers .

The report delivers :

Executive Summary – The opening section of the report provides, in plain English a executive summary overview of the entire assessment including recommendations to improve the security posture of the in scope environment.

Graphical Summary – Key findings are ranked, split into three impact categories and positioned in a graphical table according to the relative risk or likelihood of exploit.

Security Evaluation by Category – The evaluation ratings compare information gathered during the course of the engagement to “best in class” criteria for security standards. An evaluation of “Excellent”, “Satisfactory”, “Fair” or “Improvement Required” is provided. Each category includes a best practice statement, evaluation result and recommendation to achieve best practice.

Vulnerability Analysis – The vulnerability analysis section provides a detailed description of each discovered flaw including any necessary technical information and corrective recommendations.

Exploitation Probability – Each listed vulnerability is assigned a “Probability” rating based upon how likely the vulnerability is to be exploited.

• Test delivered under industry best practice methodologies by qualified consultants
• Determines the security level of your externally facing infrastructure
• Provides clear instruction on how to further secure your externally facing infrastructure

Find out about complete range of Penetration Testing Services in Pakistan as provided by Tier3.

Summary
product image
Author Rating
1star1star1star1star1star
Aggregate Rating
4.5 based on 19 votes
Brand Name
Tier3
Product Name
Web Application Penetration Testing
Price
PKR 50000
Product Availability
Available in Stock