Penetration Test Case Study: Enterprise Annual Audit Check
Protect your sensitive information with advanced technique and manual testing
For a higher security level
Many companies have their own IT and security team. Yet, a third party security checkup is required for some business to satisfy regulatory needs. It is to ensure that they are capable to cope with security threats from hackers. However, many traditional cybersecurity service providers treat testing as a trivial routine task and may not have the capacity and willingness to perform thorough penetration test. To truly reinforce your system, a white-hat hacker with years of experience is needed.
Client background
The client is a giant global commercial group, with businesses in real estate, shopping mall, F&B and so on. They are required to perform security check for all the computer systems every year. The test lasted for 3 months and involved more than 100 domains, including e-commerce sites, mobile application and internal systems for staff. Some tests for ad hoc company events are also needed to meet regulatory requirements and prevent data leakage. Therefore, they approached UDomain for penetration test service.
Test process and results
Penetration test is performed by a qualified “pentester” to simulate an attack on a target computer system, in order to find its vulnerabilities and prevent real hacker intrusion. UDomain’s Cybersecurity Analyst Chris Chan says “Penetration test is to analyze a system from an outsider’s angle, according to established procedures and technique. It’s nothing like what movies have been showing. You can’t do it with a few clicks.”
The test starts with locating publicly available information related to the client to better understand the target, such as the version of their CMS system. Using that information, the pentester can seek way to exploit and get into the systems. We found serious vulnerabilities at this stage already.
The target system was then scanned remotely by automated software in a non-intrusive way. Since not every scanning result is genuine, it is not meaningful to simply report these findings. Hence, the pentester had to verify the findings one by one to eliminate useless results.
What penetration test differs from vulnerability scanning is the manual part, which requires experience from the pentester and could identify much more types of flaws.
A test involving more than 100 domains and system will result in a large amount of information. It would be hard to clearly express the findings. In order to let the client more easily to understand the results, we grouped similar problems together and gave detailed explanation and recommendation. Even there isn’t any vulnerability, we also listed out what tests we conducted. At last, we organized a debriefing session with the client. “However, when we found any serious data breaches like login name and password, we notified the client immediately to avoid loss. We will not wait for the reporting to disclose such important information,” Chris says.
Why UDomain’s penetration test?
UDomain’s pentesters have the OSCE qualification for performing penetration test. The skill required to pass the examination is more than what is needed for penetration test. Programming and other advanced testing technique is required for the examination that lasts for days.
The number and quality of vulnerabilities identified by pentester depends on the experience of the said pentester himself. UDomain’s pentesters have perform tests on websites, mobile application and infrastructure for banks, social service organizations, schools. There is no reason to doubt our expertise.
Some “penetration tests” performed by some cybersecurity company are, in fact, merely vulnerability scanning. There is no manual test. Yet, the charge could be horrifying. UDomain’s penetration test service is 100% authentic and can guard you against hackers.
Key Takeaways
“The technique of hacking is improving every day. Simply deploying firewall or password is not enough to stop all attacks. Whether to meet regulatory requirements or better protect company data, penetration test should be conducted,” Chris concludes. Yet, it is not easy to find a qualified and experienced pentester in Hong Kong. UDomain’s “white hat hacker” team with our years of experience will do everything we can to protect you and your invaluable data.
