{"id":4996,"date":"2021-04-23T15:10:25","date_gmt":"2021-04-23T15:10:25","guid":{"rendered":"https:\/\/wp.pentestfactory.de\/pentesting-as-a-service\/"},"modified":"2021-05-18T12:20:17","modified_gmt":"2021-05-18T12:20:17","slug":"pentesting-as-a-service","status":"publish","type":"page","link":"https:\/\/dev.pentestfactory.de\/en\/pentesting-as-a-service\/","title":{"rendered":"Pentesting as a Service"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t
\n\t\t\t\n\t\n<\/svg>\t\t<\/div>\n\t\t\t\t
\n\t\t\t\n\t\n<\/svg>\t\t<\/div>\n\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Approach<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Pentesting as a Service (PTaaS)<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Agile projects or systems with an elevated risk often require more than a single penetration test. We offer Pentesting as a Service as an effective measure to continuously assess the security posture of your target systems.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

More than a snapshot<\/h2>\t\t\t\t
\n\t\t\t\t\t

The security of applications and infrastructural components is not a one time goal, but rather a continuous process. This is why penetration tests should be employed in a continuous context. Especially agile projects and systems with a high innovational degree can develop vulnerabilities with every new function and release.<\/p>\n\t\t\t\t<\/div>\n\t\t\t

<\/div><\/div><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n \n\n
\n
\n
\n <\/i>\n <\/div>\n <\/div>\n
\n

\n Continuous Testing <\/h3>\n \t\t \t

Your systems are not assessed once, but continously evaluated and monitored.<\/p>\n <\/div>\n \n \n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n \n\n
\n
\n
\n <\/i>\n <\/div>\n <\/div>\n
\n

\n No Overhead <\/h3>\n \t\t \t

The contractual overhead of classical pentests occurs only once for pentest programmes.<\/p>\n <\/div>\n \n \n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n \n\n
\n
\n
\n <\/path><\/svg>\n <\/div>\n <\/div>\n
\n

\n Fast Reaction Time <\/h3>\n \t\t \t

The time necessary to identify a vulnerability is measurably reduced.<\/p>\n <\/div>\n \n \n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n \n\n
\n
\n
\n <\/i>\n <\/div>\n <\/div>\n
\n

\n Cost Effectiveness <\/h3>\n \t\t \t

The costs per pentest decrease notably, as less time needs to be alotted for test preparation.<\/p>\n <\/div>\n \n \n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n \n\n
\n
\n
\n <\/i>\n <\/div>\n <\/div>\n
\n

\n Evaluation of Measures <\/h3>\n \t\t \t

Not only new vulnerabilities are identified, but implemented measures are verified.<\/p>\n <\/div>\n \n \n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n \n\n
\n
\n
\n <\/path><\/svg>\n <\/div>\n <\/div>\n
\n

\n Integration <\/h3>\n \t\t \t

We can report findings directly to your database and integrate them, so maintenance efforts can be reduced.<\/p>\n <\/div>\n \n \n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t<\/i>\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t

Preparation<\/h3>\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In the pentest programme all tests are prepared thoroughly. Focus points can be set by you.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t<\/i>\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t

Assessment<\/h3>\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

We conduct pentests as agreed time- or action-based. They follow our established quality standards.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t<\/i>\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t

Re-Test<\/h3>\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Generally a retest of all findings is conducted automatically with every cycle. We thus document the implementation of measures and their effectivity continuously.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t<\/i>\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t

Reporting<\/h3>\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

All results are reported in a coordinated format. Generally, a reported is omitted after the intial pentest has been conducted and new results are presented as a list.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Pentesting as a Process<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Regular and highly flexible<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

With a pentest programme or pentesting as a service you do not need to go without flexibility. The advantage lies in the integration of pentests into the process. A pentest can be initiated regularly or action-based e.g., with a new release.<\/p>\n

One of the most important factors with regular testing is a constant testing intensity. This is why we conduct every penetration test manually. Automated tooling is only used as an aid. Additionally we rotate the employees used in pentest programmes to guarantee an objective assessment from multiple viewpoints.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\n\t\n<\/svg>\t\t<\/div>\n\t\t\t\t
\n\t\t\t\n\t\n<\/svg>\t\t<\/div>\n\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\n \n
\n\n \n 34.23%<\/span>\n\n \n \n \n\n\n <\/div>\n \n

About a third of registered CVE vulnerabilities was registered in the last three years. In summary 52.168 entries.<\/p>\n\n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\n \n
\n\n \n \n \n \n <\/path><\/svg> <\/span>\n\n \n\n\n <\/div>\n \n

The mitigation of a vulnerability should always be accompanied by a retest to verify and confirm the implemented measures. <\/p>\n\n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\n \n
\n\n \n 84%<\/span>\n\n \n \n \n\n\n <\/div>\n \n

According to a report by Positive Technologies (Feb 2020), over 80% of vulnerabilities stem from misconfigurations.<\/p>\n\n <\/div>\n <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Frequent Questions regarding Pentesting as a Service<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tFor which companies is PTaaS suited?<\/a>\n\t\t\t\t\t<\/h5>\n\n\t\t\t\t\t

Pentesting as a Service or the classical Pentest Programme make sense for companies that have an elevated risk profile and use agile infrastructure or applications. If you expect regular attacks to your systems, a regular security assessment is also recommended.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tCan a Pentest Programme be understood as some contingent?<\/a>\n\t\t\t\t\t<\/h5>\n\n\t\t\t\t\t

The configuration of a Pentest Programme is very flexible. It can contain clearly defined pentests or serve as a test contingent. If you know that you need a certain amount of penetration tests per year, a Pentest Programme is reasonable.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tIs a Pentesting Programme not associated with high costs?<\/a>\n\t\t\t\t\t<\/h5>\n\n\t\t\t\t\t

On the contrary. The costs per pentest are notably lower than ordering every pentest individually. This comes down to the fact that overhead is reduced e.g., contractual agreements only need to be signed once. Furthermore expenses for coordination and reporting can be reduced.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tDoes it make sense to test the same system over and over again?<\/a>\n\t\t\t\t\t<\/h5>\n\n\t\t\t\t\t

In a complex infrastructure a Pentest Programme can of course be applied to multiple systems. Oftentimes internal policies mandate that all components of an application need to be tested once a year. Together we then compile a yearly schedule and vary the scope of our assessments to cover all components.<\/p>\n

Furthermore, new vulnerabilities might arise in constant systems from system updates. At the same time, new vulnerabilities are discovered every day and with every penetration test more vulnerabilities are evaluated.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Approach Pentesting as a Service (PTaaS) Agile projects or systems with an elevated risk often require more than a single penetration test. We offer Pentesting as a Service as an effective measure to continuously assess the security posture of your target systems. More than a snapshot The security of applications and infrastructural components is not […]<\/p>\n","protected":false},"author":4,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-4996","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/dev.pentestfactory.de\/en\/wp-json\/wp\/v2\/pages\/4996","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.pentestfactory.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/dev.pentestfactory.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/dev.pentestfactory.de\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.pentestfactory.de\/en\/wp-json\/wp\/v2\/comments?post=4996"}],"version-history":[{"count":0,"href":"https:\/\/dev.pentestfactory.de\/en\/wp-json\/wp\/v2\/pages\/4996\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.pentestfactory.de\/en\/wp-json\/wp\/v2\/media?parent=4996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}