Blog

In this post, we'll discuss common questions on how to become a consultant within cyber security.

Open-source software projects are, in theory, more secure than closed-source/proprietary software due to the clear disclosure of security vulnerabilities and the potential for source code review.

Linux is commonly the preferred operating system used by Ethical Hackers and 'Infosec' professionals due to the following factors.

The CIA triad is a security model of three core principles used within IT security and Information Security policies within an organisation. These principles relate to the Confidentiality, Integrity, or Availability of systems or information.

Broken authentication refers to a weakness in the design or implementation of access controls inherent in an online platform or application.

Unless you are working directly with AWS then you will not be able to run a pentest against the AWS cloud environment directly. You are only permitted to test against 'your' deployments of specific AWS services as detailed within the following guidance from Amazon.

Python is well-known as a fast, simple and easy, readable scripting or programming language. Those features make Python one of the most used languages for hacking, especially when it regards automated actions during the enumeration and exploitation phase.

A physical penetration test (pen test) is where an ethical hacker or social engineer will try to gain entry to one of your locations, such as an office building, warehouse, storage facility or data centre.

Payment Card Industry (PCI) Penetration Testing or more commonly shortened to PCI Pen Testing is running penetration tests for the purposes of the PCI Data Security Standards (DSS) compliance.

An OSCP Penetration Test or OSCP Pentest typically means that a Penetration Test is carried out by someone who has achieved the Offensive Security Certified Professional (OSCP) certification. The OSCP is a Penetration Testing certification run and managed by an organisation called 'Offensive Security'.

Nmap is a port scanning tool used by penetration testers and hackers to identify exposed services.

The aim of the pen test is to identify weaknesses and flaws within the infrastructure’s attack surface and leverage them to gain elevated and persistent access.

A false positive within cyber security refers to an alert or vulnerability that has been incorrectly flagged, usually caused by unpredictable behaviour which is triggered by a test case.

There isn't really such a thing as 'the best laptop' for a pentester to use. It also really depends on the type of pen test you are conducting. We suggest you go with what budget you can afford and opt for as much RAM as possible for running virtual machines (VMs).

Cloud Penetration Testing or 'Pentesting' typically refers to the testing of a Cloud-hosted environment such as against Amazon Web Services (AWS), Google Cloud Platform (GCP) or Microsoft Azure.

Penetration testing an Android application involves both the application operation, similar to how a web application test is performed through capturing the outbound and inbound network traffic and targeting the APIs or web services used by the application, along with the client application and how it operates on the device itself.