Risk Response Strategies
As a pentester, it would be a mistake to assume that all vulnerabilities will be fixed on the client's side. From a purely economic point of view, a fix is not worthwhile if it causes higher costs than a criminal exploitation. Our finding could also be a business requirement for the target system or application, which management has explicitly decided on. For example, social network operators often choose not to automatically terminate a user session after the user has been inactive for a long period of time, even though this issue is listed as a vulnerability in penetration testing standards such as the OWASP Testing Guide. In terms of the usability of social networks, such a decision is also understandable, since the average usage time would presumably be reduced if users have to authenticate themselves again each time. However, from an IT security perspective, a missing session timeout is associated with risks. One threat scenario, among others, would be that third parties could perform actions on behalf of an absent application user. Basically, the following strategies are available to our client to respond to risks:
- Risk mitigation: Countermeasures are taken for the risk.
- Risk transfer: The risk is shifted, e.g., by software outsourcing or taking out insurance.
- Risk acceptance: The risk is consciously accepted by the management.
- Risk avoidance: Functions are omitted that could have a negative impact on a company's operations.
Since we cannot be sure that all vulnerabilities will be addressed on the client's side, it is even more important that we clearly communicate the potential for damage. Regardless of our view, the client should carry out its own risk assessment, as we do not know all the background information from the company.
Pentest Training
Take a look at the pentest training chapters and learn penetration testing:
- Preface
- Introduction
- Legal Framework
- Hacking vs. Penetration Testing
- Classification
- Meaningfulness of Penetration Tests
- Penetration Testing Standards
- The Hacking Guide
- Hacking I: Scanning networks
- Hacking II: Password attacks
- Hacking III: Web application attacks
- Hacking IV: Privilege Escalation
- Hacking V: Tunnelling Techniques
- Hacking VI: Vulnerability scanner and penetration testing frameworks
- Demonstration of a Penetration Test
- Risk Assessment of Identified Vulnerabilities
- Structure of Documentation and Reporting
- Insider stories: Tales from Dubius Payment Ltd.
binsec academy GmbH – Advanced Pentest Training Lab
binsec academy GmbH operates the Pentest Training Lab, a highly practical online platform dedicated to real penetration testing. Simulating complex corporate networks and advanced real-world attack scenarios within isolated lab environments, it is engineered to sharpen the skills of aspiring and professional penetration testers. Upon conquering our rigorous, fully practical examination, participants earn the distinguished Binsec Academy Certified Pentest Professional (BACPP) designation — proving their technical capability to methodically uncover and evaluate vulnerabilities in modern IT infrastructures.
Explore the Pentest Training Lab
binsec GmbH – Experts in Penetration Testing
As the operative pentesting core of the binsec group, binsec GmbH has provided high-end, human-led penetration testing since 2013. Rejecting automated scans, our permanently employed, certified senior pentest experts deliver manual deep-dive assessments of web applications, APIs, mobile apps, complex network infrastructures, cloud environments, and advanced red team simulations. Specializing in high-regulation sectors like Payment, Banking, and Healthcare, we provide clear risk evaluations and actionable reports to effectively assess your business-critical systems.
Get Manual Expert Penetration Testing Services