Home / Security / Protection & Security / Testing

Testing

Test, test, test.

A key part of protecting your data is continuous testing. Our strategy is based on the OWASP testing guide, with a dedicated service probing the live endpoints around the clock.

OWASP Top 10Real-timeSeparation of concernsnmap
Our approach

Only the kernel needs testing.

Because the UI/view-controller is separated from the model, we get a testing advantage: we only have to exhaustively test the infrequently-changing kernel — the entityOS API.

The testing service

A dedicated, independent probe.

Beyond OWASP and nmap tooling, our own testing service continuously exercises security through the functional endpoints. It runs on infrastructure independent of the entityOS service.

Functional Endpoints Availability · port access · responses Common Security User: authN, authZ, accountability Data: integrity, threat protection Data Layer User data · system data / logs SECURITY TESTING SERVICEPort accessAvailabilityResponsesAuthenticationAuthorisationInjectionLoggingAll requests go via the functional endpoints. ISO 27001/17 Certification evidence ALERT to operations

The testing service exercises every layer via the functional endpoints. Passing evidence feeds the ISO 27001/17 audit; any exception raises a real-time alert to operations.

  • Port access via scanning — only 80/443 open when unauthenticated, 443 when authenticated.
  • Authentication — including perfect forward secrecy.
  • Authorisation
  • Availability
  • Accountability — monitoring & logging is actually occurring.
  • HTTP responses
  • Injection — search & manage
  • SSL & DNS — certificate expiry and CAA records.
Sample real-time tests

What triggers an alert.

A sample of the checks the service runs continuously. Any exception to the expected result triggers a real-time alert to ibCom operations.

TestWhat the service doesAlerts operations if
LoggingAuthenticates as a known user, then queries the logs to confirm the authentication was recorded.No matching log entry
Port scan (unauthenticated)Scans ports 1–65565.Any open port other than 80 or 443
Port access (auth method)Attempts to authenticate over port 80 / HTTP.Response status is not ER
InjectionQueries the API with parameters using known SQL-injection techniques.Response status is not ER
HTTP responsesChecks no Server detail is returned and that Strict-Transport-Security is present.A server name is present
AvailabilityChecks the service is reachable.No response
DNSChecks for the presence of a CAA record.CAA record not found
SSLChecks the certificate expiry date.Expiry within one week
Infrastructure

Staying current.

Infrastructure is constantly updated to deal with current threats. The Web Application Firewall uses the latest control sets to stay current, and all service endpoints are accessed via AWS Elastic Load Balancers.

We subscribe to daily threat-intelligence updates so that new vectors are understood and mitigated quickly.

AWS load balancers

All endpoints sit behind AWS Elastic Load Balancers.

Web Application Firewall

Latest control sets applied continuously.

Evidence

Testing that proves itself.

Evidence of this automated testing is a key part of the external audit of our ISMS and our compliance to ISO 27001/17.
View Certificates OWASP Testing Guide