The main retail dates of the second half of the year are approaching: Black Friday
and Christmas. Therefore, offering security in online shopping is fundamental to guarantee good results. That means pentest and vulnerability reduction.

A booming vulnerability market

Moreover, the vulnerability assessment market – vulnerability management market, or VA
– keeps booming. It should grow around 10% a year through 2027, according to Mordor
Intelligence. Part of this expansion comes from the search for professionals able to stay
ahead of cybercriminals. The goal is to protect sensitive data,
a subject we covered in our last blog article.
Likewise, the global cost of cybercrime remains on an upward path.
Back in 2018, a study by the Center for Strategic and International Studies (CSIS) already estimated
around US$ 600 billion a year, or 0.8% of global GDP. Since then, the figure has only grown.
The bill includes data destruction, theft of
intellectual property, and stolen money.
Along these lines, VA work consists of identifying, classifying, and
mitigating flaws. These are vulnerabilities found in software or hardware.

A market that keeps on growing

VA
professionals apply tests able to detect system flaws through
their weak points. In this way, it becomes possible to act preventively.
Among the working methods is the so-called pentest, or penetration test.
It is an analysis that evaluates the security of a system or network. It simulates
an attack from a malicious source. The idea is precisely to find and exploit
vulnerabilities, supporting the work of the
security teams.
The relationship between pentest and e-commerce
In 2022, Brazilian e-commerce moved R$ 187 billion, a
20% rise over 2021, according to the Brazilian E-commerce Observatory. The pandemic
had accelerated that curve a few years earlier. However, the digital channel has since become
a consumption routine in the country.
Meanwhile, two of the biggest e-commerce dates are approaching: Black Friday
and Christmas. Therefore, businesses must keep these systems running in a
steady and secure way. As we showed in this article, instability is a major
problem in this period. After all, it causes direct losses in sales.

And how can pentest be used for e-commerce?

• Payment security – You need to test how the payment solution integrates with the
  e-commerce platform. Moreover, the test helps detect malicious scripts at checkout,
  a technique used to capture card data. The goal is to avoid errors and build credibility with the
  consumer.
• Personal data protection – Brazil’s General Data Protection Law (LGPD) has been in force since 2020, and the ANPD already applies sanctions. Therefore, a data leak creates serious economic and reputational problems. In addition, the company must report the incident within the legal deadline, which requires preparation in advance.
• Server continuity – With Black Friday and Christmas approaching, tests
  can reveal the limits of your systems. Overload comes from malicious attempts or
  from an unusual demand spike, which is common on these dates.
  As a result, you can act preventively and
  define response plans.
• Catalog integrity – Imagine losing inventory data on the eve
  of the busiest dates? Currently, ransomware encrypts and also copies that
  information, with a threat of publication. Therefore, your company needs immutable, tested backups.

When each test makes sense

• Traffic diversion and bot abuse – Cybercriminal creativity knows no
  limits. Some attacks divert a site’s traffic. The goal is to collect
  consumer data on a copy of the original store.
  Moreover, credential stuffing bots have grown, testing leaked passwords against customer accounts.
  These are some examples of attacks that are increasingly
  common in Brazil. They can disrupt an e-commerce operation during the
  highest-revenue dates. Broadly speaking, the retailer must
  map every entry point and mitigate
  it. That includes APIs and third-party scripts loaded on the page.
  As a rule, these cyberattacks are not continuous, especially if
  criminals find adequate barriers. In those situations, they
  look for other opportunities on sites with a weaker structure.
  Learn how to prepare your IT structure for Black Friday in this guide, including the
  security aspects.
  Types of pentest
  Although it is a broad term, the pentest can be
  divided into a few categories:

From blind testing to authenticated testing

• Internal and external infrastructure penetration – The idea is to detect vulnerabilities
  in the security infrastructure, such as firewalls and the corporate network. Its
• application can happen internally (with access inside the company) or externally. Among the fixes is changing router and firewall configurations.
• Wireless penetration – In this case, the main focus is the local wireless network (WLAN) and its vulnerabilities.
• Web application and API testing – The purpose is to identify weak points in applications and in the APIs that support checkout. After all, many of today’s flaws sit in the integration layer.
• Mobile applications – These are security assessments related to mobile operating systems, such as Android and iOS.
• Social engineering – The idea is to assess the ability to detect and respond to common attacks. That is the case of phishing scams, now written with generative AI and free of obvious mistakes. Moreover, voice deepfakes already appear in approval requests.
• Cloud and supply chain penetration – Cloud solutions became the rule. In addition, the store depends on plugins, gateways, and third-party scripts. Therefore, it is important to test those links as well, especially in hybrid cloud.

Therefore, each of these tests has specific goals. Moreover, each one demands a different level of
pentest work and can deliver very distinct results.

The types of pentest, in practice

The professionals involved use
a range of tools and strategies. The goal is to scan for vulnerabilities and stress the
systems in several ways.

The ideal testing routine

The idea is to run this assessment periodically – at least once a year.
However, it pays to repeat the test after relevant changes, such as a new gateway or integration.
In this way, you act preventively and avoid data theft.
In general, results come in a report format. It brings the specification
of the flaws found and the recommendations to fix them.

Likewise, do you know whether your security structure is aligned with best practices? Talk to one
of our specialists. Find out how Inove Solutions works to guarantee your
business security!