Types of audits
Audits at Secure Sense can be performed in two ways to identify vulnerabilities in your website, network, mobile apps, and other online technology. These methods are a greybox or a blackbox audit. Both are briefly explained below.
Greybox audit
During a greybox security audit, prior knowledge about the object(s) to be tested is provided. This may include, but is not limited to, providing information about the operation of the target object, user accounts, and network drawings or granting access to a target that is not publicly accessible. This allows for a more in-depth test, with a better understanding of the context. A greybox audit is often more effective and efficient than a blackbox audit due to the available prior knowledge.
Blackbox audit
A blackbox security audit is performed as much like a remote attack by an unknown attacker as possible. This means that no (or almost no) information is provided to the tester before the audit.
How long does a security audit take?
How long an audit takes depends on the environment(s) within the scope. This will be mapped out during the introductory and intake interview. For a regular website, a 16- or 24-hour audit is recommended, while 40 hours is ideal for a more extensive website. An infrastructure audit will probably take at least 40 hours.
What’s the difference between a security audit and a vulnerability scan?
The biggest difference between an audit and a vulnerability scan is the scope, depth, and logical thinking. A vulnerability scan provides an overall picture of known vulnerabilities, outdated software, and common configuration errors. A security audit goes a lot further and provides a more detailed picture of the security of the researched environment in question, and the researcher uses a dose of creativity to look for vulnerabilities. A security audit, therefore, provides a more complete picture of security and goes through the same steps that a hacker will follow during an attack.
