Cyberattacks have become one of the biggest challenges facing businesses. In the following interview, Jan Girlich, a security expert at iteratec, explains how organisations can specifically protect their applications against vulnerabilities and attacks. He shares practical insights into application penetration testing, discusses regulatory requirements and demonstrates why a modern approach to application security is crucial for sustainable business success.
As the threat landscape grows, businesses are investing more and more in cyber security. What role does application penetration testing play in this?
Software components – whether developed in-house or purchased – are one of the most common entry points for cyber-attacks on businesses. It is important to realise that every application, every digital service and every new piece of software contains security vulnerabilities. The question companies should be asking is: who will find them first? The company itself, or someone on the internet? This is precisely where application penetration testing comes into play. The aim is to identify and rectify security vulnerabilities that jeopardise the application’s availability or the integrity and confidentiality of data before any damage occurs – such as a data breach or an application failure.
How do you go about this?
We adopt the attacker’s perspective. Attackers exploit, for example, errors in the business logic of in-house developed parts of the website or known vulnerabilities and security flaws in the frameworks and libraries used to attack applications. We trace these paths and use various methods to simulate attacks on the application. It is important that these checks are always adapted to the specific usage context and take individual application scenarios into account. This enables us to identify security vulnerabilities quickly and precisely. Thanks to our expertise and many years’ experience in the field of software development, we possess a deep understanding of how software works, the ability to familiarise ourselves quickly with complex systems, and the experience to rapidly identify critical (code) areas within a system.
Application penetration testing therefore helps to uncover security vulnerabilities in good time – but that doesn’t actually make the application any more secure, does it?
That’s correct – and application pentesting is also just one component of a holistic end-to-end security approach. But it provides an ideal basis for specifically enhancing application security. On the one hand, by not only highlighting security vulnerabilities but also assessing their severity. This enables organisations to deploy their security resources specifically where the need for action is greatest. On the other hand, the final report also provides concrete recommendations for remedying the identified vulnerabilities. Good application penetration testing therefore does not leave the client with just a list of findings, but enables them to close security gaps effectively and sustainably.
To what extent is application penetration testing already being used by companies in Germany today?
This depends, amongst other things, on the size of the company, its level of security maturity and the specific industry sector. Particularly in regulated sectors, such as the financial sector or the pharmaceutical industry, regular application-based penetration testing forms part of standard practice and is mandated by the authorities. Unfortunately, even here one repeatedly comes across companies that view application pentesting purely as a compliance requirement and have no interest in examining the findings and their causes in greater depth. Yet a test report should not merely serve as evidence for management, regulatory bodies or investors – but, first and foremost, as a working document for the development teams, enabling them to ensure and further improve application security.
What is preventing the effective use of application penetration testing in organisations today?
One common reason is undoubtedly the lack of security personnel, which is why the topic is often not an integral part of software development projects from the outset. Another reason is that application pentesting is usually carried out during critical project phases, e.g. shortly before an application goes live or a new release is launched, when time pressure is high and the willingness to deal with adjustments is low. Consequently, application pentesting is often perceived as a showstopper in such situations.
How can we prevent application penetration testing from becoming a showstopper?
I think we need to turn the perspective on its head. A penetration test is often the last chance to fix security vulnerabilities before the costs of application security spiral out of control. This is because, as soon as an application goes live, both the costs of fixing security vulnerabilities and the potential damage caused by a successful cyberattack increase exponentially. A proactive approach, in which security vulnerabilities are identified and patched before an attack occurs, therefore makes sense not only from a security perspective but also from a business perspective. One could even go so far as to say that companies which address security vulnerabilities early and proactively enjoy long-term competitive advantages, as they face lower reputational risks, have a lower risk of downtime and lower maintenance costs, and – last but not least – are better prepared for current and future regulatory requirements.
You’ve already mentioned the regulated sector – to what extent do regulatory requirements drive the adoption of application penetration testing?
Regulatory requirements are always a powerful lever in the field of security. By making certain security measures legally mandatory and imposing sanctions for non-compliance, the pressure on companies to take action in this area increases.
This can currently be seen in the example of the NIS2 Directive, which will come into force in Germany in October 2024 and will also oblige smaller companies in sectors closely linked to KRITIS to demonstrate effective protection against cyber-attacks. Here, too, application penetration testing plays a vital role in demonstrating the security of both a company’s own systems and the third-party systems used throughout the IT supply chain.
However, with regard to regulatory requirements, it is always important for companies to develop a fundamental understanding and awareness of the importance of application security, going beyond individual pieces of evidence and sets of rules once they have been established. Penetration testing can be a suitable tool here for highlighting areas where action is needed and drawing management’s attention to them.
Apart from regulatory requirements – in your experience, how has the approach to application security changed in recent years?
The finding is this: the number of attacks has risen steadily in recent years and continues to rise, partly because the potential targets are becoming ever larger. At the same time, however, the importance of cyber security as a critical factor for business success is also increasing significantly.
This is because, in almost all sectors, customers’ perceptions are increasingly shaped by the quality of digital products and services. The underlying systems are thus becoming strategic assets for companies, which are highly relevant to the business, customers, shareholders and investors, and must therefore be given special protection. A temporary, unplanned outage of an application due to a cyber attack, or the reputational damage caused by the uncontrolled leakage of customer data, is likely to have an even more direct impact on the value and valuation of companies in the future. Cyber security is thus also becoming a competitive factor, whether in terms of customer recommendations, analyst valuations or assessments carried out as part of due diligence processes. Companies that have a clear picture of their security posture consequently enjoy clear competitive advantages. Application penetration testing can be a sensible first step in this regard.
Thank you for your time and for this fascinating interview!
Do you have any questions or need assistance?
You can find out more about the benefits of penetration testing for your business on our website. Feel free to get in touch or arrange an appointment.
