API testing can be an unnerving task if you aren’t quite sure where to start.
API Security
There are a number of things to consider when it comes to API security testing.
We perform API security testing by analyzing both request and response. To clarify, this is done in order to discover and fix security vulnerabilities earlier in the software development cycle.
For instance, whether you’re using REST, SOAP, or a mix of both, we’ve got your APIs covered.
Further, a detailed analysis of JSON and XML are performed as part of our API security testing process.
All of our API Penetration Tests go beyond national standards – such as OWASP – and your test will come with a detailed final report.
Your detailed final report will include an executive summary, a listing of findings, risk ratings and remediation recommendations. In addition, a letter of accreditation can be provided upon your request.
During the API penetration testing process, automated, as well as comprehensive manual testing, will be used to identify existing vulnerabilities at the API/message layer of your applications.
Here at MainNerve, our API security testing process involves a comprehensive, risk-based approach to manually identify critical API vulnerabilities.
Throughout the API security process, a number of professional tools will be utilized to perform an in-depth test. Example tools may include: BurpSuite, RestClient, SOAPUIPro, and more.
Following the conclusion of the API penetration test, MainNerve will provide a comprehensive final report that details all findings associated with the test.
Understanding the Application
The first phase of the API penetration test is critical to the success of the test. It is very important that the team understands all of the features and functions of the application.
The team does this by browsing through the application, going through the user manuals or, if required, a walkthrough of the application along with the application owner or developers. We work with you to ensure we are fully aware of its aims, functions, etc.
Creating the Threat Profile (Test Plan)
The threat profile comprises a list of potential threats against the application that we have identified. The threat profile is the starting point for all subsequent tests.
We map each threat in the threat profile to specific pages on your site. The test plan then identifies all the attacks we need to carry out on those pages to assess that specific threat.
Manual and Automated Testing
Once the test plan and test cases are prepared and approved by a senior member of the team, the API penetration testing begins. This will comprise a combination of manual and automated checks that adhere to the test plan.
During the course of testing the tester may identify additional tests or attacks to perform, in which case the test case will be updated and subsequent tests performed. The team takes up the threats one by one and starts performing the tests.
If a test case is successful, then it is marked as unsafe in the test plan.
Reporting
At MainNerve, we consider the final phase of the API penetration testing process, reporting, to be the most crucial and instrumental step. Once the team is through with the API testing, the reporting process begins.
The detailed report delineates each vulnerability discovered as well as the method of discovery. Potential solutions to each finding are also included.
The report is made available, securely, to the client after it has been reviewed internally.
Mobile application penetration testing will assess the state of risk to your mobile application and provide remediation recommendations you can use to address any vulnerabilities discovered. MainNerve’s testers will apply the OWASP Methodology as they thoroughly examine your application.
Ensure that your business is secure by testing and evaluating your employees against general phishing and “spear-phishing” attacks.
Web application penetration testing is designed to assess and test the state of your web-facing applications and provide actionable remediation recommendations for enhancing your security. Ensure that your web applications are protected from malicious cyber threat actors.
Network penetration testing assists with the identification and examination of vulnerabilities for external, Internet-facing and internal, intranet systems. A network pen test will help determine whether an attack can exploit and compromise targeted systems. Take the next step to improving your business’ security with a network pen test.
From PCI DSS and HIPAA, to CJIS and FINRA, MainNerve can help your business navigate the GRC landscape with specialized penetration tests.
What Our Clients Say
In 12 years of tests, you are the first company that found anything higher than a low risk. Phone and cameras were never discovered in the test, let alone accessed. Great to always get a different perspective from a test.
Our local partner that normally provides us with vulnerability and penetration testing was unable to help us this year. We were lucky enough to find MainNerve as a solution to our problem. MainNerve was very responsive to us and worked under a very tight timeframe to perform vulnerability and penetration testing for us and help us out of a tough situation. They went above and beyond. They provided us with some additional guidance in other security areas as well. We will continue to use MainNerve each year now for our security testing needs. We are glad we found them.
I was quite pleasantly surprised by the engagement. I think the thing I liked best about it was that everyone at MainNerve really took the time to listen and understand what we did, why we were doing it, and our business goals. It gave us confidence that we were in the right hands.
Always nice to have a dependable vendor that is fully committed and reasonably priced.
It’s been a great partnership for the last 4 years. When NYDFS Cybersecurity regulation was announced back in 2017, I did not have much experience in the security fields such as risk assessment, vulnerability assessment, and Penetration testing and was not comfortable creating the plan. I was searching for information on the internet and came across multiple companies. I contacted MainNerve and they explained the process as well as their background which gave me comfort in the overall process as well as the confidence in the MainNerve team. Also, the cost was very reasonable. Going through the signing, planning, assessment, testing, and reporting, they were in constant contact with me and updated me with steps they are taking and when I can expect the next milestone. When we had delays, they were patient and worked with us. We finished all the assessment and testing in the expected time and now we just do it annually. As our IT environment expands, we increase the scope of the testing, and MainNerve has been very flexible with our plans, budget, and timing. I have introduced the MainNerve to colleagues in other companies in NY and they are also satisfied with the service.
Our company has used MainNerve for a number of years for penetration testing. They are very professional and very thorough. They are careful about not disrupting the organization during the testing and they walk you through the test results in a way that makes understanding them very straightforward. We’ll be using them again soon.- Google Review
We have utilized MainNerve for three years for our penetration tests as required by our clients. They have always provided fast, efficient, precise and detailed reports that prove more than sufficient to meet our industry’s high level of data security requirements. Pricing is more than reasonable and they are always available to help and provide guidance when needed. Highly regarded and recommended.- Google Review
MainNerve performs periodic Penetration Testing and Vulnerability Assessment for GETIDA web servers. We are completely satisfied with their service level, response times, and pricing. The final reports are useful for both IT professionals (taking care of the findings) and managers (general understanding of information relevant for sales and customer service) here in GETIDA. Also, the reports were viewed and approved by Amazon security auditor. Good job!- Google Review
Great Experienced staff, made the process fast and easy. I appreciated the attention to detail throughout the whole process and will 10/10 use and recommend for those looking to test their network security.- Google Review
