Test Controls: Achieve Visibility and Control Over All Pentesting

00:05 Hello, listeners. You're tuning to Cut to the Chase podcast. Today, we're diving into deep in the world of pen testing, focusing on the vital aspects of visibility and control. I'm Yvesnay Picon. Yes, my last name is a little bit unique there. My last name means spicy, and I am your guide for today, and I am a solutions architect here here at SYNNAC, and, let's jump right in. Security shouldn't be an afterthought. Whether you're launching a killer app,

00:37 freshening code base or sending into the cloud, you need a strategy that integrates security from the get go. I get it, like, typically security is a block. It's a slowdown, right? But let's dispel that myth here. Security doesn't have to slow you down. Actually, in fact, if it's done right, it should accelerate the mission. And during this session, the things that we're going be talking about today offers the cutting edge, secure approach to pen testing.

01:08 We'll explore innovative features that set SYNNAC apart from others, everything from one click pause functions to in house C2 callback servers, all aimed to offer you unmatched control, visibility, and above all, peace of mind in an ever evolving threat landscape. So sit tight. This is one episode that you don't want to miss.

01:43 And so we're going to talk about pausing a pen test, pausing an assessment, just pausing a test in general. And what you see here, this is actually our platform. There's a lot of good things here. I don't have time to show it all. There's just a lot of good things, but let's just focus on pausing an assessment for now. So what we're gonna do is we're gonna go here. We're gonna go to assessments, and you see, right here, you have the ability to pause all assessments all at once,

02:15 or you can select which tests you want to pause, one or two or, you know, three or four. That way, don't if you don't want to pause all of them, you can just do one at a time. And here at SANAC, you know, we understand that things happen on a day to day basis, so whenever those things happen, we want to make sure that you have the ability to pause the test at any point. One of the great things about this is, you know, you don't have to come to us, you don't have to reach out to us,

02:46 you do this on your own, because a lot of times with my customers, you know, they really like the fact that actually, I had a CISO at an oil industry, oil company expressed to me that he was really delighted to know that this PAWS assessment was actually there, because there was a situation that happened on their end, and they just didn't have time to communicate with us or do anything like that. And the fact that they could just pause the assessment and

03:16 then internally with their team, they were just able to discuss things that needed to be done, but knowing that that's the thing that occurred and interfered with our testing, but they could just pause the test, which was a really big deal for them. Really big relief as well. And, you know, those are one of the things that we really like, you know, to give for the pause assessment, to pause the test, because you don't have to wait on us, you don't have to rely on us, although we're there for you, but you can just do it within seconds.

03:49 The next thing that I really want to discuss, and this is a really helpful feature as well, we're going to go to assessments. And, again, there's a few ways to do things, but I'm just gonna go the easy route. We're gonna go to an actual assessment. And when we scroll down here, firewall allow list IP addresses. This is our way to to whitelist our SYNNAC IPs. This is a really great feature, you know, to have. You know, one of the reasons that we wanna have this feature is to

04:21 make sure that we can distinguish friendly traffic, which is us at SYNAPH versus malicious activity. You know, I was actually talking with one of my customers, a big financial company, and one of the things that the CISO expressed to me was that, you know, they have a big blue team, and they don't have time to sift through all the different things that occur within the environment on a day to day. So they wanted to know how is it that we can make their life

04:51 easier to understand when we test, when we start to test. Hey, can you let us know when that happens? Well, I was able to let them know about this feature whereby we actually do give warning orders, actually, to, let you know when we're gonna test, but the thing is we actually will whitelist, our SYNNEX IPs, and we distinguish them versus scanning traffic versus the human led traffic. That way, when you see traffic, the blue team can easily die easily detect when

05:22 it's a SYNNAC IP address, and not just SYNNAC IP address, but also what type of activity is it. Is it the scanning or is it the human led? And when I explained that to the CSO, I mean, he was really delighted because this basically knocked a lot of time and confusion for the blue team when the day to day operations are happening, and it made the test really smooth. They didn't have to worry about, you know, getting a notification for us about when we're testing or anything like that. It just made their life really easy.

05:56 You know, the next thing I'm gonna go to is coverage analytics. This is actually one of my favorite features that we have here. You know, the focus here is really giving that panoramic view of security testing beyond just vulnerabilities, that are identified. We use real time traffic logs to show, like, which domains, subdomains, API endpoints, IPs, that's been assessed. Alright? Because a lot of times, you know, with a pen test,

06:28 you want to make sure that, are you getting the coverage that you expected? This actually gives also accountability to us and for you as to, hey, are we testing what we said we were going to test within scope that we discussed before starting the test? So example is, you know, a lot of time customers will ask about, Hey, you know, how do I know for sure if a particular endpoint has been tested? And this is where they can go to look at that, and you can really go to all

07:01 tests that we've been testing, and you can just pick which one you wanna go to, And, I mean, we can just continue to drill down from the domain, down to sub domains, even to APIs, and, you know, you can look at the traffic for our researchers. We have amount of hits that happen, and one of the things that's really that's good also is that even with the classified traffic, you can also look at the percentage of traffic of what's

07:32 been going to certain attacks. Let's say for the top ten OAuth, for example, know, we have a list here. Let's say, hey, for the SQLite, you know, we'll be getting, like, thirteen percent of traffic with this particular, you know, asset or particular, endpoint that we're really trying to focus on. And that way, the customer feels really comfortable knowing that, Hey, you know what? Okay, I do see that we have a good coverage there, but also in the situation that, Hey, you know what? I looked at the coverage analytics,

08:03 I've noticed that this particular endpoint that I'm looking at, I want a little bit more coverage on this. So there, we can, here at SYNNAC, guide our researchers, which is our security testers. We can guide them to that endpoint after the customer has said, You know what? I would like a little bit more coverage in this area. So that way it's keeping everybody accountable, you're getting the holistic view of all your, you know, your whole posture, basically, you know, not just from a standpoint of vulnerabilities,

08:33 but just really what's actually been looked at, what's been tested. Are there areas that we need to focus on more, or why is this area not focused on as much as others, you know? We can really look at all those different things from coverage analytics, which is just a great, really, like, covering any gaps. Now, the next thing I want to discuss here, and we don't necessarily have a reason to show this in the portal, but we do have a slide for this.

09:04 You know, this is a really important thing as well as, Hey, how do our researchers test? You know, How does this testing occur? We want to know all that. So this is a really helpful thing to understand is our security researchers, when they're conducting tests, they're doing that on Synack owned and controlled workspaces, you know, VDIs. And, you know, one of the things There's a few things that's great about this. I this enhances security.

09:35 There's a lot of transparency involved because we can make sure that we have full capture on all activities with our researchers. This also really helps with understanding that all our researchers are testing the same way. There's a consistent pattern that you know that the way that our researchers are testing. There's an audit trail as well, a comprehensive audit trail, which is important for compliance and safeguards as well. And, you know, one of the things about this is, you know,

10:06 so it was really interesting, I was at a conference talking to a security engineer and, you know, he had a really good question. He was trying to understand that we were talking about different things and we happened to talk about, you know, how does it look like when we're doing, you know, web testing? You know, a lot of times you might use Burp Suite to do web testing and how secure is that, you know? How much control do you have there? And I was able to tell him about, you know, our C2 infrastructure, which really sets us apart because we've established a way in house to have a C2 callback server,

10:37 which allows us to keep testing all testing communication within our four walls. You know, because this way, it really helps us maintain a strict, controlled type of testing, ensuring that the client data never leaves a secure monitoring environment. You know, we wanna we really reassure that to the customer. And honestly, by keeping all the XEET2 communication internal, we not only eliminate the risk of data exposure, but also ensure that we meet compliance standards. This method enhances the security and the integrity of

11:08 our testing, you know? And the security engineer was really glad to hear that because, you know, he one thing he did say was that his CISO, when it comes to pen testing, especially with different tools, they really would rather not see any hiccups, anything that's going to knock anything out in a very negative way to impact their environment. So to understand that, you know, we have those four walls, know, we have the testing done within those four walls, I mean, he was really happy to hear this.

11:40 So, you know, in summary, with all the things that we talked about today, we're redefining what it means to conduct security testing today in the digital landscape that we're in today. You know, we offer you control, flexibility, transparency. You need to secure your assets without hindering innovation and operation. From the one click pause feature to IP whitelisting, from real time coverage analytics, which is, again, my favorite feature to securing our testing environments, we're really committed to providing that three sixty degree,

12:10 that holistic approach of viewing and controlling your security posture. So, you know, when you think of robust, comprehensive, and accountable security testing, think SYNNAC. Thank you for tuning in, and remember, in a world of evolving cyber threats, your security shouldn't be a question mark. Make it a statement with SYNNAC. And remember, can always find us at SYNNAC dot com.