Pentesting: Security Audit, Red Team, Purple Team, What Are The Differences?

Pentesting Security Audit

According to IBM’s X-Force Threat Intelligence Index 2020, 60% of cyber attacks exploit either stolen credentials or known software vulnerabilities. Between 2018 and 2019 the exposed data reported increased by 200%.

On the other hand, companies now have a legal obligation to secure their IT systems to limit the risk of personal data leakage. This obligation has been reinforced by the GDPR law (General Data Protection Regulation), in force since May 25, 2018. In the event of a proven attack, companies must now make declarations relating to the loss or leakage of data, personal data of their customers, suppliers or employees. Hacking attempts can therefore no longer be passed over in silence, at the risk of undermining and tarnishing the image of the companies that are victims of them and of generating significant financial impacts.

In this context, the pentest takes on its full meaning. While hackers are constantly improving their techniques and new uses facilitate access to sensitive data, pentesting makes it possible to adapt and optimize IT security, while anticipating and facilitating decision-making.

More information you can find here.

PENTEST OR INTRUSION TEST: LET’S AGREE.

The pentest, also called penetration test, is an ethical hacking technique consisting of testing the vulnerability of a computer system, an application or a website by detecting the flaws that could be exploited by a hacker or malware.

Pentesting can be done automatically using software applications or can be done manually by a pentester. Whichever option is chosen, the various stages of this strategy are based on identifying points of vulnerability and attempting to penetrate the heart of the system, allowing key information to be obtained to improve cybersecurity.

PENTEST VERSUS SAFETY AUDIT: TECHNICAL OR FUNCTIONAL APPROACH

Security auditing should be differentiated from pentesting. For the tester, it is not a question of putting itself in the shoes of a professional hacker but of carrying out an in-depth study of its client’s information system, on the basis of discussions with the IT team and the analysis of its technical documentation.

Auditing helps identify potential vulnerabilities without predicting whether they are actually exploitable. This method therefore does not allow scenarios to be anticipated and the security policy to be adjusted accordingly.

The audit by a security testing company can support the specifications of CIOs as part of the creation or overhaul of an IT system. However, security auditing does not protect the company from the economic consequences of an attack. It does not provide a contextualized solution to consolidate or strengthen the security strategy in place in a pragmatic way.

PENTEST IN RED TEAM MODE: IN REAL CONDITIONS

Red teaming: Red team testing consists of testing an organization’s IT security system by evaluating and testing each of the protective measures they implemented (for example: anti-virus software, data encryption, compliance, awareness of teams, and IT security plans).

Orchestrated like a real attack, this service makes it possible to carry out all types of realistic scenarios without any prior limit being set. It goes well beyond the attempted intrusion and allows testing of all aspects of IT security, for example:

the physical intrusion of third parties likely to access IT tools, such as service providers or suppliers,

employee manipulation attempts (social engineering) including retrieving information through fraudulent e-mails or targeted phone calls,

the vulnerability of physical infrastructures (accessibility of servers and computer workstations, installed security software, etc.).

PENTEST IN PURPLE TEAM MODE: THE EMPLOYEE IN ACTION

PurpleTeam: This strategy is a bit different, in that it doesn’t rely on putting a team of attackers and opponents into perspective. On the contrary, it consists of creating a single team, in order to federate and strengthen collaboration between auditors and all internal IT security players.

The PurpleTeam relies on different levers to gauge the responsiveness of the IT department and employees. Through working groups, training and workshops, providers assess and optimize detection capacities.

Each method has its advantages, but some require in-depth work and rigorous business involvement. As a general rule, it is recommended to start with a pentest or a security audit, before considering methodologies that are based on real-life scenarios, such as RedTeam.