Requirement for Website Penetration Testing

The overall aim of the project is to independently measure the effectiveness of security controls within the website, from an external perspective, outline any vulnerabilities and recommend improvements. Specific objectives are: • Assess the level of exposure that the site could present • Assess whether access levels can be escalated (known as privilege escalation) • Assess whether an unauthorised user can modify the site contents for other users • Assess whether any forms on the site allow unauthorised modification of data outside their intended purpose (i.e. SQL Injection attacks) • Assess the level of this exposure from an external attack (in regards to the protection of data held in the system) to ensure that security controls and coding controls are fit for purpose • Measure the degree of compliance with good practice • Identify actions that will reduce any identified risks to an acceptable level • Recommend improvements in security controls to prevent unauthorised access and misuse of the service (i.e. obtaining data of registered users of the site)