Security · · Davi Netto
Why do companies pay over R$10,000 a month to be hacked?
Breaking into companies can be profitable. Learn why companies hire pentest professionals to break into them.
Have you heard of penetration testing? A penetration test, or intrusion test, is an authorized simulation of a malicious cyberattack that many tech companies carry out to find flaws in their technology infrastructure before a malicious competitor, hacker or former employee exploits them.
How penetration tests are done
Pen tests involve the most varied forms of intrusion, such as cracking the password of the corporate Wi-Fi network, trying to plug USB drives with malicious code into a company computer, and even fake interactions with the company’s employees intended to extract sensitive information.
In more extreme cases, companies such as Amazon pay for tests in which they’re physically broken into by professionals who know how to pick locks, disable camera circuits and alarms and get past the on-site security team.
How much does a pen test cost?
The image of nerds at a computer in their basement is a thing of the past. Security companies and professional pen testers offer their services online and can be easily hired.
Prices vary widely, usually between 4 and 100 thousand dollars. The monthly salary of highly skilled ethical hackers can reach 30 thousand dollars, depending on their skills. Many may find these amounts very high, but what’s the cost of having your customers’ sensitive information made public? And the cost of having your company’s strategic plans sold to your competitor? In the internet age, information is power, and it may be your company’s most valuable asset.
I don’t have 30 thousand dollars. What should I do to protect my company?
Many actions can be taken to reduce the risk of a vulnerability in your company. One of the first steps to protect your company is to put data security policies in place and keep training your employees.
Most intrusions exploit human vulnerabilities. If a company sent free USB drives to your sales team, would they use them? If an employee received “by mistake” an email from HR with the updated spreadsheet of positions and salaries, would they open it? Would any of your former employees be willing to sell usernames and passwords if offered money?
Maybe breaking into a company is easier than you think. Maybe it doesn’t even take a single line of code.
What about you: do you know your company’s vulnerabilities?
