• Skip to main content

The Security Bureau

Take control of your information security

  • About us
  • Services
  • Challenges
  • Resources
  • Contact us
  • Informer

What to consider when you’re requesting a penetration test…

25th November 2017 by The Security Bureau

jumping

Any decent penetration testing supplier would want to know as much as possible about the system that you have asked them to security test. However, they should start by finding out about your motivation for requesting a penetration test. Penetration testers are naturally interested in the technology you’ve used, but they should be penetration testing your system by getting into the mind of your attackers and targeting the information you’re trying to protect.

Try to give your penetration testers as much information as possible about why you’re requesting a penetration test and who your threats may be. To scope as accurately as possible, try to determine the potential risk to the system – this will then determine your budget for the security test. Reputable penetration testing suppliers should be able to help you with an understanding of the different approaches for security testing and what would be suitable for a system of the size and type that you have.

If you haven’t got a formal risk assessment process, here are some of the questions you can think about and provide the penetration testing supplier with the answers to. Think about the following:

What are your main security concerns?

  • Stealing credit card data
  • Website defacement
  • Stealing user’s personal information
  • Gain access to the backend systems
  • Commit fraud. E.g. buying items for less than advertise

Who are your likely attackers?

  • Unknown attackers from the internet?
  • “Trusted” users. E.g. employees, customers.
  • 3rd Parties and your supply chain

What kind of information do you store and process?

  • Employee data
  • Customer data
  • Credit card data
  • Intellectual property

The Security Bureau takes this approach further where we try to understand your business and understand what you could stand to lose should you be affected by an incident. Our experience means that we can help to reduce their risk to the right level.

Contact us to find out more about our approach and how effective it is. Our email address is info@thesecuritybureau.com or feel free to contact us on 01273 855 269.

Filed Under: Infrastructure Penetration Testing, Insights, Security Guides, Web application security testing

twitter icon
linkedin-icon
  • Privacy policy
  • Site by Vgroup
© 2023 The Security Bureau