Penetration Testing: 5 herramientas que ayudan a su ejecución
Las empresas de Chile y todo LATAM se enfrentan cada vez a una mayor cantidad de ciberataques, lo que hace que la seguridad informática sea una prioridad para muchos negocios.
Website Vulnerability Scanner
Test de penetración: ¿Cada cuánto tiempo se debería realizar y en qué áreas?
Un test de penetración o pentest es una prueba de seguridad que simula un ataque de hackers al sistema para identificar vulnerabilidades y detectar posibles amenazas. Esto permite a los responsables de seguridad tomar medidas para protegerse frente a ataques cibernéticos.
GDPR Compliance: How Continuous Vulnerability Scanning is Key
Even months after interest in GDPR compliance peaked, some companies are struggling to make sure they comply with this new set of regulations aimed at protecting the privacy and security of European citizens. The regulation applies to businesses anywhere as long as their users are in the EU, and with the highest penalties potentially reaching the millions of euros, they’re right to worry.
Take the case of British Airways for example. On September 6th, 2018 the airline announced that it had suffered a breach that affected around 380,000 users, and that part of the stolen data included personal and payment information.
Now, although we don’t know the fine that will be levied on British Airways, under GDPR a violation such as this one may lead to a fine of €20 million or up to 4% of a company’s annual turnover in the previous year (whichever is higher), which for BA could reach about £489 million (US$633 million) based on 2017 figures.
A similar case is that of Marriott. In November 2018 they announced that they had been a victim of an attack that compromised the data of 500 million users. Marriott’s annual turnover in 2017 was US$22.9 billion.
More recently, Google has been the target of a €50 million fine in France for failing to provide enough information to users about its data consent policies and not giving them enough control over how their information is used.
Often when we read about GDPR, it may sound like it’s all about notifications (letting users know what kind of data the company is using and how it will be used and notifying them of security breaches in a timely fashion), but if these cases show us anything it’s that companies will be under scrutiny not only for how they use their customer’s data but also how they protect it. This is where early detection and prevention of security vulnerabilities is key.
Article 32 of the GDPR provides that businesses must
“implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including […] as appropriate: […] a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.”
These are the 10 web vulnerabilities most frequently found by Hackmetrix
After having run thousands of scans on Hackmetrix we can finally say we officially know the 10 most common vulnerabilities we’ve found across every site we scanned.
The purpose of the article is to be a source of information for users who have found any of these on their sites, to encourage site owners to check their online properties for any of these, and to provide a line or two on how to fix them wherever possible.
If you’re not sure how to check your site for any of the vulnerabilities mentioned here, then a free Hackmetrix account could be a good start. It only takes a minute to sign up and you’ll have your first report in just a couple hours.
As time goes by we’ll also be expanding on each of these with more in-depth guides explaining each of these issues and how to solve them.
Let’s get to it!
- Absence of Anti-CSRF Tokens – Risk: Low
Our most frequently found vulnerability is (luckily?) not a high risk one. Cross Site Request Forgery (CSRF), is a type of attack that tricks a user’s browser into performing an unwanted action on a trusted site where the user is authenticated, and it works even if the user doesn’t have that site open at the time.
This works because of the trusting nature of web browsers. A browser doesn’t check to see if an outgoing request is going out from a specific domain, and so in a similar way you might be able to tweet or check an Instagram post from an external website, a more ill-meaning site could use an open session in one of those sites to post, or take some other action, on your account without you ever noticing.
For example, let’s say you regularly check Twitter and so your session on that site remains open (an open session is what makes it possible for you to open a new tab and go to twitter.com and see your feed without having to log in every time). While you’re checking your friends’ tweets you click on a very enticing link to a questionnaire to find out what kind of fast food you are. Irresistible.
That questionnaire though, holds hidden and nefarious intentions, and as soon as you click a button on it to see the results it takes advantage of your open session on Twitter to tweet on your behalf a link to itself and follow a bunch of unknown accounts. This without you ever consenting, or finding out until you look at your own feed.
Now take that and imagine it being used on, instead of Twitter, a bank account. CSRF is a common problem, and one of the ways it can be prevented is by using =&2=&.
Using an anti-CSRF token would mean that each time a website loads it includes a unique string of characters, then when a request is made (in our example that would be each time you try perform some action on Twitter), the server expects to receive that same token back, and if it doesn’t then it will refuse to perform the action requested. You can see then why it’s highly recommended to implement an Anti-CSRF Token, and why not doing so is considered a vulnerability.
=&3=&=&4=&
How we check your security status
What do we do?
If you are reading this, you’ve probably already heard about us, and in this post I do not want to talk about =&0=& , instead I’d like to talk about =&1=& with almost no information other than your domain name.
To understand =&2=& it’s important to understand that the process of a Penetration Test follows a series of flexible rules, the same rules that we apply in our methodology of Automatic Security Analysis. You will find detailed information in this post about this process and how we use these steps to automate the security analysis process.
=&3=&
How to combine Pentesting with Automation to improve your security
If you’ve been involved in software development in recent years, then you should be aware of the term “Penetration Testing”.
Penetration testing (or pentest) is as popular as ever. I continue to find organizations that spend a lot of money on pentest as their primary means of security, testing periodically while they are in production, yet they are still hacked constantly.
New digital technologies and modern computer platforms allow organizations to rapidly deliver new products and services, create agile business models and revenue streams and enhance operational efficiency.
However, deploying changes faster is a double-edged sword. Consider for a moment what happens when changes contain bugs – or security issues? If there are no systems in place to guard against flawed changes being released, we risk bringing our systems down much faster too.
In this challenging software environment, businesses require a new approach: annual audits are no longer enough. In this article, we explain how you can merge manual penetration testing with automated security testing to improve your security.
New techniques for modern applications
Combining manual penetration testing and automated security testing results in a comprehensive and effective approach to safety. Although they are different, they are not mutually exclusive.
In-depth manual pentests weed out complex attack vectors. However, the amount of code pushed live every day poses a challenge as it is increasingly difficult for security teams to keep track of the latest threats. With the help of automated tools, problems can be discovered before the new code goes into production.
What are the benefits of combining annual penetration testing and automated security testing?
By using automated tools, developers can identify and solve security problems throughout the development cycle. So, while your development team solves the security problems before implementing production updates, the pentesters will concentrate on complex vectors, optimising time and cost.
How can you automate your security testing?
If you have an expert on your team or some free time in your sprint, you can integrate on-premise and open-source tools such as Nessus,
Acunetix
Hackmetrix 2.0 released with Free Plan, More Powerfull Tests and Better UX
Our team continuously strives to improve the happiness and comfort of our customers. We are in charge of understanding developers’ challenges in searching to improve their software security without sacrificing development time, which is quite limited!
That’s why we are working really hard every day to make our tool as useful as possible with our website vulnerability scanner that performs fully automated tests to identify security issues on your web application & networks.
Hackmetrix team is convinced that security can (and must!) be a part of the development process, without the necessity of paying a security expert, or spending late nights focused on security and thereby putting sprints at risk.
So, what’s new in Hackmetrix?
After our first versions utilized a “pay-per-use” model, we received a lot of users’ feedback requesting a SaaS and complaining about the non-user friendly PayPal interface. In response to this feedback, we have decided to turn our tool effectively to a SaaS, integrating the Stripe platform for payments.
Get a Free Plan
Together with the big change to SaaS, we are introducing a FREE plan, which comes with a free scan/IP per month!! Now you can check your site’s security status every month, Totally Free. Of course, if you need more, we also offer the PRO Plan, which comes with three scanners/IPs and more powerful tests only for USD $18 per month.
More friendly!
Backed by
Hackmetrix 2018. All rights reserved.