Application Penetration Testing.

Many people ask whether they should just stick with vulnerability analysis tools or use the comprehensive services of a 3rd party web application penetration testing company. Let's take a look at how the web application industry has evolved over the last decade, and then look at how application penetration testing has emerged to meet the challenge.

Pre-2000, the Age of Internet Dinosaurs

Yes, there was an Internet before 2000, but like the Land Before Time, it was a drastically different landscape. Some companies had a website for marketing purposes, but it was more novelty than anything else. As the web began to become more popular, companies started to consult experts to do application penetration testing on their systems. Usually the tools were simple, but so were the tricks of the hackers, so everything ran pretty smoothly. The market for web application penetration testing had been born, but it was still in its infancy.

Early 2000s

Following the Dot com bust, companies began using the web and web applications for internal as well as external applications. These typically were still on non-web-based platforms, but the legacy applications were used in web environments. Customers however began purchasing more things online, leading companies to further pursue effective web application penetration testing.

There were generally 2 different strategies for application penetration testing. One approach was to hire or contract web application penetration testing experts to test all web based applications before going live. The problem was not enough resources to test all applications, which left holes open for exploitation. Another trick was to test the web based application with vulnerability tools before it went live. This was a more economic approach, but it still missed many key vulnerabilities.

The Question of Today

The problem has grown worse today, as the proliferation of web-based interfaces and applications has grown to include our every day lives and our business. Web based applications are being used for everything a company does on a computer, growing increasingly complex. The integrity of website security has never been more important, and companies are left with 3 options. Should they use analysis tools, use their own people to do application penetration testing, or hire a 3rd party web application penetration testing company?

The need for experience in application penetration testing will increase. At the same time, you can't trust everyone in your company, especially in this day and age of mass layoffs. Hiring a 3rd party for web application penetration testing is by far the most secure option, as you get hands on expertise that isn't inside the company where security can be compromised.

About the Author:

Julio Carmona is the author of this article on Web-Application Penetration Testing. Find more information about Application Penetration Testing here.