{"id":39296,"date":"2020-11-09T10:35:46","date_gmt":"2020-11-09T02:35:46","guid":{"rendered":"https:\/\/zegal.com\/?p=39296"},"modified":"2023-11-07T16:24:07","modified_gmt":"2023-11-07T08:24:07","slug":"penetration-testing","status":"publish","type":"post","link":"https:\/\/zegal.com\/en-gb\/blog\/post\/penetration-testing\/","title":{"rendered":"Penetration Testing and Meeting Compliance \u2013 What You Need to Know"},"content":{"rendered":"
\n
\n

\"penetration<\/h3>\n
\n
\n
\n
\n
\n
\n
\n
\n

We often have clients coming to us for penetration testing services for compliance reasons. Companies that handle sensitive data such as FinTechs and healthcare providers are often required to undergo routine penetration testing by third-party security providers. In this post, we gather Pragma\u2019s security experts to answer common questions on penetration testing and how we help in meeting compliance.\u00a0<\/span><\/p>\n

First, what exactly is penetration testing?\u00a0<\/span><\/strong><\/h4>\n

Penetration testing is when a professional tester (like us) acts as an ethical hacker to access an application or systems externally. The whole idea is to detect undiscovered vulnerabilities using different methods in bypassing security mechanisms that are set in the application.\u00a0<\/span><\/p>\n

Does my company need a penetration test?\u00a0<\/span><\/strong><\/h4>\n

A company should undergo a penetration test regularly (at least annually). This is to either catch new vulnerabilities that may be introduced overtime or existing undetected vulnerabilities. A penetration test should also be done when new features are being deployed to the system or if there were to be any new configurations added or changed like a change of firewall rules or changes in the permission set for admin\/member roles.\u00a0<\/span><\/p>\n

Most of the time, companies undergo penetration testing for compliance purposes. It could be compliance to International Security Standards such as ISO 27000, or industry-standard such\u00a0Payment Card Industry (PCI) Standards<\/a>, regulations such as Monetary Authority of Singapore Technology Risk Management and third-party reporting standard such as Service Organisation Report SOC2 further requires Vulnerability Assessment and Penetration Testing to achieve compliance.<\/span><\/p>\n

I need to comply with regulatory requirements. What type of penetration testing should my company go for?\u00a0<\/span><\/strong><\/h4>\n

White, grey box and black testing are the main types of testing. White box means the tester has full information on the application, grey box means most information is known (and usually involved having credentials for testing) and black box is where the tester has no idea of the system at all. Either Grey box or white box is preferred to gain deeper insights on vulnerabilities in the system.\u00a0<\/span><\/p>\n

When a client comes to us for penetration testing for compliance obligations, we generally test the following areas that will satisfy most compliance requirements. However, please speak to us if you require testing beyond these scopes.<\/span><\/p>\n