{"id":840,"date":"2020-09-24T16:00:00","date_gmt":"2020-09-24T20:00:00","guid":{"rendered":"https:\/\/www.pwvconsultants.com\/blog\/?p=840"},"modified":"2020-09-24T15:50:24","modified_gmt":"2020-09-24T19:50:24","slug":"pen-testing-timing-is-everything","status":"publish","type":"post","link":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/","title":{"rendered":"Pen Testing: Timing is Everything"},"content":{"rendered":"\n

Penetration testing is an integral part of ensuring the security of your systems and applications. <\/p>\n\n\n\n

It is a form of ethical hacking<\/a>, which we previously discussed<\/a> in a three-article series<\/a>. According to CodeDx<\/a>, \u201cA penetration test, or pen test, is a simulated attack against your web application. Previously, penetration testing was mostly performed on networks, rather than the applications running on those networks.<\/p>\n\n\n\n

The purpose of a pen test is to identify vulnerabilities in your application exploitable from an outside attacker. Penetration testing can be performed against the various types of code and systems used in your application, such as APIs and servers.\u201d<\/p>\n\n\n\n

Now that you know what it is, the question then becomes, \u201cWhen is the best time to do a pen test?\u201d<\/p>\n\n\n\n

Many companies do pen tests on existing applications<\/a>, which is good and should be done annually. But companies often miss an opportunity when testing is done in prod. This is because you want to know that prod is safe. When you do a pen test, you will end up with a lot of tickets because the test will find weaknesses, that\u2019s what it\u2019s designed to do. So when you put an app in prod and THEN test it, you have to remember that this is a product that\u2019s been out there with these weaknesses. You\u2019ve already been exposed and potentially already been breached. The truth is you don’t know what those vulnerabilities may have led to when they were wide open. <\/p>\n\n\n\n

When you are going to launch a major product or product iteration, you\u2019ve done a major rewrite or code refactor, etc., you should do a pen test while you are still in staging, before you ever move to prod. Yes, pen tests are expensive and you probably don\u2019t want to do 20 in a year, but any time a set of features results in a significant change in your system and could potentially create a significant change in your security patterns, it is recommended to do a pen test, preferably an external, white hat pen test. You want to have prod secure on day 1 not day 1001.<\/p>\n\n\n\n

It is almost always better to do a white hat test than a black hat test. Doing a black hat test in prod for posterity or to see whether or not someone can get to you, if they don\u2019t have any information on you or your company becomes meaningless. Many attacks involve insider information because people are easier to hack than machines. It\u2019s much easier to pose as a potential hire and show up for an interview where you can ask questions of an employee to gain information about systems than to endlessly experiment. There are other traditional methodologies employed by con artists to get that information as well. Which is why white hat tests are better, they give you more information on what someone who is targeting you is likely to get into. Even if you\u2019re simply doing an annual prod pen test to see where you might have vulnerabilities, white hat is the way to go.<\/p>\n\n\n\n

Think about it. If someone out there is your worst case nightmare scenario and knows everything about you process, systems and business, they\u2019ll know exactly where your weaknesses are. Doing a white hat test should leave you feeling confident that when those tickets are closed, you\u2019ll have every known weakness resolved. And you can weather even the most targeted, well-funded attack. <\/p>\n\n\n\n

Pen testing is incredibly important to do on a regular basis, but it is also important anytime there\u2019s a major change to your product. Which is why, aside from doing annual checks on your applications, you should always test new features or anything that could change security protocols. Data breaches, ransomware, viruses, worms, insider threats, etc. are all potential problems for any business. It is essential to test apps to ensure they stay safe and secure.<\/p>\n","protected":false},"excerpt":{"rendered":"

Pen testing is an important part of your application security process. Knowing when you should test for weaknesses is essential.<\/p>\n","protected":false},"author":1,"featured_media":848,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[10,5,14],"tags":[1169,602,31,1822,1831,1674,539,577,1830],"yoast_head":"\nPen Testing: Timing is Everything - PWV Consultants<\/title>\n<meta name=\"description\" content=\"Pen testing is an important part of your application security process. Knowing when you should test for weaknesses is essential.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Pen Testing: Timing is Everything\" \/>\n<meta property=\"og:description\" content=\"Pen testing is an important part of your application security process. Knowing when you should test for weaknesses is essential.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/\" \/>\n<meta property=\"og:site_name\" content=\"PWV Consultants\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/PWV-Consultants-110444033947964\" \/>\n<meta property=\"article:published_time\" content=\"2020-09-24T20:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-09-24T19:50:24+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/09\/cyber-security-3400555_1920.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1152\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Pieter VanIperen\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@PWV_Consultants\" \/>\n<meta name=\"twitter:site\" content=\"@PWV_Consultants\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pieter VanIperen\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/\"},\"author\":{\"name\":\"Pieter VanIperen\",\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/#\/schema\/person\/c15d5d40126a8ad906cb3067de95f8d4\"},\"headline\":\"Pen Testing: Timing is Everything\",\"datePublished\":\"2020-09-24T20:00:00+00:00\",\"dateModified\":\"2020-09-24T19:50:24+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/\"},\"wordCount\":663,\"publisher\":{\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/09\/cyber-security-3400555_1920.jpg\",\"keywords\":[\"Application Security\",\"Coding\",\"Cybersecurity\",\"data privacy\",\"data protection\",\"ethical hacking\",\"hacking\",\"pen testing\",\"penetration testing\"],\"articleSection\":[\"Application Security\",\"Cyber Security\",\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/\",\"url\":\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/\",\"name\":\"Pen Testing: Timing is Everything - PWV Consultants\",\"isPartOf\":{\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/09\/cyber-security-3400555_1920.jpg\",\"datePublished\":\"2020-09-24T20:00:00+00:00\",\"dateModified\":\"2020-09-24T19:50:24+00:00\",\"description\":\"Pen testing is an important part of your application security process. Knowing when you should test for weaknesses is essential.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#primaryimage\",\"url\":\"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/09\/cyber-security-3400555_1920.jpg\",\"contentUrl\":\"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/09\/cyber-security-3400555_1920.jpg\",\"width\":1920,\"height\":1152,\"caption\":\"Image by Pete Linforth from Pixabay\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.pwvconsultants.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Pen Testing: Timing is Everything\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/#website\",\"url\":\"https:\/\/www.pwvconsultants.com\/blog\/\",\"name\":\"PWV Consultants\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.pwvconsultants.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/#organization\",\"name\":\"PWV Consultants\",\"url\":\"https:\/\/www.pwvconsultants.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/04\/logo-alternate-e1585773530392.png\",\"contentUrl\":\"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/04\/logo-alternate-e1585773530392.png\",\"width\":98,\"height\":84,\"caption\":\"PWV Consultants\"},\"image\":{\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/PWV-Consultants-110444033947964\",\"https:\/\/twitter.com\/PWV_Consultants\",\"https:\/\/www.linkedin.com\/company\/pwv-consultants\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/#\/schema\/person\/c15d5d40126a8ad906cb3067de95f8d4\",\"name\":\"Pieter VanIperen\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.pwvconsultants.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8b294918257a810803e2befc9a71b7bc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8b294918257a810803e2befc9a71b7bc?s=96&d=mm&r=g\",\"caption\":\"Pieter VanIperen\"},\"description\":\"PWV Consultants is a boutique group of industry leaders and influencers from the digital tech, security and design industries that acts as trusted technical partners for many Fortune 500 companies, high-visibility startups, universities, defense agencies, and NGOs. Founded by 20-year software engineering veterans, who have founded or co-founder several companies. PWV experts act as a trusted advisors and mentors to numerous early stage startups, and have held the titles of software and software security executive, consultant and professor. PWV's expert consulting and advisory work spans several high impact industries in finance, media, medical tech, and defense contracting. PWV's founding experts also authored the highly influential precursor HAZL (jADE) programming language.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/pwv-consultants\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Pen Testing: Timing is Everything - PWV Consultants","description":"Pen testing is an important part of your application security process. Knowing when you should test for weaknesses is essential.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/","og_locale":"en_US","og_type":"article","og_title":"Pen Testing: Timing is Everything","og_description":"Pen testing is an important part of your application security process. Knowing when you should test for weaknesses is essential.","og_url":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/","og_site_name":"PWV Consultants","article_publisher":"https:\/\/www.facebook.com\/PWV-Consultants-110444033947964","article_published_time":"2020-09-24T20:00:00+00:00","article_modified_time":"2020-09-24T19:50:24+00:00","og_image":[{"width":1920,"height":1152,"url":"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/09\/cyber-security-3400555_1920.jpg","type":"image\/jpeg"}],"author":"Pieter VanIperen","twitter_card":"summary_large_image","twitter_creator":"@PWV_Consultants","twitter_site":"@PWV_Consultants","twitter_misc":{"Written by":"Pieter VanIperen","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#article","isPartOf":{"@id":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/"},"author":{"name":"Pieter VanIperen","@id":"https:\/\/www.pwvconsultants.com\/blog\/#\/schema\/person\/c15d5d40126a8ad906cb3067de95f8d4"},"headline":"Pen Testing: Timing is Everything","datePublished":"2020-09-24T20:00:00+00:00","dateModified":"2020-09-24T19:50:24+00:00","mainEntityOfPage":{"@id":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/"},"wordCount":663,"publisher":{"@id":"https:\/\/www.pwvconsultants.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/09\/cyber-security-3400555_1920.jpg","keywords":["Application Security","Coding","Cybersecurity","data privacy","data protection","ethical hacking","hacking","pen testing","penetration testing"],"articleSection":["Application Security","Cyber Security","Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/","url":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/","name":"Pen Testing: Timing is Everything - PWV Consultants","isPartOf":{"@id":"https:\/\/www.pwvconsultants.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#primaryimage"},"image":{"@id":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/09\/cyber-security-3400555_1920.jpg","datePublished":"2020-09-24T20:00:00+00:00","dateModified":"2020-09-24T19:50:24+00:00","description":"Pen testing is an important part of your application security process. Knowing when you should test for weaknesses is essential.","breadcrumb":{"@id":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#primaryimage","url":"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/09\/cyber-security-3400555_1920.jpg","contentUrl":"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/09\/cyber-security-3400555_1920.jpg","width":1920,"height":1152,"caption":"Image by Pete Linforth from Pixabay"},{"@type":"BreadcrumbList","@id":"https:\/\/www.pwvconsultants.com\/blog\/pen-testing-timing-is-everything\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.pwvconsultants.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Pen Testing: Timing is Everything"}]},{"@type":"WebSite","@id":"https:\/\/www.pwvconsultants.com\/blog\/#website","url":"https:\/\/www.pwvconsultants.com\/blog\/","name":"PWV Consultants","description":"","publisher":{"@id":"https:\/\/www.pwvconsultants.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.pwvconsultants.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.pwvconsultants.com\/blog\/#organization","name":"PWV Consultants","url":"https:\/\/www.pwvconsultants.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pwvconsultants.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/04\/logo-alternate-e1585773530392.png","contentUrl":"https:\/\/www.pwvconsultants.com\/blog\/wp-content\/uploads\/2020\/04\/logo-alternate-e1585773530392.png","width":98,"height":84,"caption":"PWV Consultants"},"image":{"@id":"https:\/\/www.pwvconsultants.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/PWV-Consultants-110444033947964","https:\/\/twitter.com\/PWV_Consultants","https:\/\/www.linkedin.com\/company\/pwv-consultants"]},{"@type":"Person","@id":"https:\/\/www.pwvconsultants.com\/blog\/#\/schema\/person\/c15d5d40126a8ad906cb3067de95f8d4","name":"Pieter VanIperen","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pwvconsultants.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8b294918257a810803e2befc9a71b7bc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8b294918257a810803e2befc9a71b7bc?s=96&d=mm&r=g","caption":"Pieter VanIperen"},"description":"PWV Consultants is a boutique group of industry leaders and influencers from the digital tech, security and design industries that acts as trusted technical partners for many Fortune 500 companies, high-visibility startups, universities, defense agencies, and NGOs. Founded by 20-year software engineering veterans, who have founded or co-founder several companies. PWV experts act as a trusted advisors and mentors to numerous early stage startups, and have held the titles of software and software security executive, consultant and professor. PWV's expert consulting and advisory work spans several high impact industries in finance, media, medical tech, and defense contracting. PWV's founding experts also authored the highly influential precursor HAZL (jADE) programming language.","sameAs":["https:\/\/www.linkedin.com\/company\/pwv-consultants"]}]}},"_links":{"self":[{"href":"https:\/\/www.pwvconsultants.com\/blog\/wp-json\/wp\/v2\/posts\/840"}],"collection":[{"href":"https:\/\/www.pwvconsultants.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pwvconsultants.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pwvconsultants.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pwvconsultants.com\/blog\/wp-json\/wp\/v2\/comments?post=840"}],"version-history":[{"count":4,"href":"https:\/\/www.pwvconsultants.com\/blog\/wp-json\/wp\/v2\/posts\/840\/revisions"}],"predecessor-version":[{"id":852,"href":"https:\/\/www.pwvconsultants.com\/blog\/wp-json\/wp\/v2\/posts\/840\/revisions\/852"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.pwvconsultants.com\/blog\/wp-json\/wp\/v2\/media\/848"}],"wp:attachment":[{"href":"https:\/\/www.pwvconsultants.com\/blog\/wp-json\/wp\/v2\/media?parent=840"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pwvconsultants.com\/blog\/wp-json\/wp\/v2\/categories?post=840"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pwvconsultants.com\/blog\/wp-json\/wp\/v2\/tags?post=840"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}