Services
Services
SOC & Attestations
SOC & Attestations
Payment Card Assessments
Payment Card Assessments
ISO Certifications
ISO Certifications
Privacy Assessments
Privacy Assessments
Federal Assessments
Federal Assessments
Healthcare Assessments
Healthcare Assessments
Penetration Testing
Penetration Testing
Cybersecurity Assessments
Cybersecurity Assessments
Crypto and Digital Trust
Crypto and Digital Trust
Schellman Training
Schellman Training
ESG & Sustainability
ESG & Sustainability
AI Services
AI Services
Industry Solutions
Industry Solutions
Cloud Computing & Data Centers
Cloud Computing & Data Centers
Financial Services & Fintech
Financial Services & Fintech
Healthcare
Healthcare
Payment Card Processing
Payment Card Processing
US Government
US Government
Higher Education & Research Laboratories
Higher Education & Research Laboratories
About Us
About Us
Leadership Team
Leadership Team
Careers
Careers
Corporate Social Responsibility
Corporate Social Responsibility
Strategic Partnerships
Strategic Partnerships

Do You Need a Penetration Test?

Penetration Testing

So you're curious about penetration testing? What is it? Do you really need it? Sure, it's useful for compliance, but is that all?

In this video, we're going to talk about:

  • What a penetration test is
  • How it can be beneficial to your organization and
  • How to start the process of having one performed

Hi, I'm Josh Tomkiel. I'm a senior manager here at Schellman on the pen test team. I've been in the industry for over 10 years, started off as a penetration tester working on web applications and internal and external networks. And now I'm on the manager side overseeing projects. What is a pen test? Do you need it? Well, let's start with what it is.

1. What is a penetration test?

A penetration test is an approved and authorized attack against either your application network or people, At a high level, those three things are what most people think of when they talk about a penetration test.

Application
On the application side, you've got web applications, you've got your APIs, application programming interfaces, your mobile apps for iOS and Android, and then other client-side applications, either browser extensions, any agents, anything that you would provide a client that they could run locally in their environment that would be covered under that bucket.

People
On the people side, you've got social engineering with spear phishing attacks going after credentials. Will they run a script or a file if presented with a convincing pretext?

Network
And then finally you've got the network side, the internal network, and assume breach assessment. What happens if one of your assets gets compromised on the internal network? What's the worst that could happen? What about from the internet? That would be an external network test. An attacker out there on the internet with no credentials, just spraying ports, looking for open services on any of your hosts that are internet facing, are there misconfigurations vulnerabilities, anything that they can exploit?

2. Do you need a penetration test and what are the benefits?

Now, do you need one? Of course, you probably have heard that it's required for many compliance initiatives, but that's not all. A penetration test is a great tool to use in a layered security approach. Maybe you're already doing vulnerability scans. If not, Schellman can help with that. That's a great way to find those low-hanging fruit items that a scanner can highlight and say, hey, you're missing patches on these machines, you need to address them. A penetration test can be beneficial for anyone, regardless of industry or vertical, or even compliance initiative. So if you're looking to have a penetration test performed, go to our website, fill out the form and one of our specialists will be in touch to help you through the process. 

About JOSH TOMKIEL

Josh Tomkiel is a Managing Director and Penetration Tester based in Philadelphia, PA with over 10 years of experience within the Information Technology field. Josh has a deep background in all facets of penetration testing and works closely with Schellman's other service lines to ensure penetration testing requirements are met. Additionally, Josh leads the Schellman's Red Team service offering, which provides an in-depth security assessment focusing on different tactics, techniques, and procedures (TTPs) for clients with mature security programs.