The Application/API Penetration Test is a security assessment designed to estimate the security level of an application, identify high-risk vulnerabilities, and recommend initial remediation steps for the assessed entities. This assessment applies to a range of software products including web systems, APIs, desktop applications, mobile applications, and more.
Methodology
The testing process combines automated application scanning tools to identify common vulnerabilities, manual techniques to uncover and exploit security gaps, and tests for business logic and authorization flaws that automated tools often miss.
CYE performs testing from the perspective of both unauthenticated (anonymous) users and various authenticated user roles within the application. At the conclusion of the assessment, findings are evaluated and rated based on the risk they pose to the organization.
Deliverables
All discovered findings are shown in Hyver, CYE’s Continuous Threat Exposure Management (CTEM) platform
Findings are analyzed in accordance with the NIST Cybersecurity Framework
Combined insights provide a clear representation of the organization’s application security maturity level
Prerequisites
To begin the assessment, the client should provide:
Technical information, access credentials, and relevant network access
Relevant documentation
A completed application scoping essentials questionnaire
Customer Engagement
A 1 to 2-hour scoping meeting is required with a client team representative
Optional weekly one-hour sessions with relevant personnel may be held during the assessment to clarify specific technical issues
Relevant Standards
A proprietary methodology based partially on:
OWASP Top 10
OWASP Web Security Testing Guide (WSTG)
Security Domains Covered
Cross-organization policies, procedures, and governance
Network level security
Servers, network equipment, and endpoint security
Application-level security
Sensitive data and information management
Identity management and remote access