Necessity: IT systems always exist security weaknesses that can be exploited by hackers. Therefore, organizations should beat hackers to the punch, particularly, find out and overcome weaknesses in its IT systems before attacks by hackers.

However, because the periodic audit of an organization’s IT system is very complicated and requires high objectivity, organizations intended to use Penetration Testing by external providers. Penetration Testing, also known as Pentest, is a form of testing whether clients’ IT systems can be attacked by playing as hackers and simulating test attacks on clients’ systems. The main objectives of Pentest service are:

• Identify security vulnerabilities in the system.
• Give recommendations and remedies for vulnerabilities detected during pentest.
• Check out the organization’s information security policies.
• Test and evaluate users’ awareness when cyber-attacks take place in the organization

Our service: Based on description of vulnerabilities in the list of Top 10 ranked by OWASP, Viettel Group (Parent company of Metfone) has developed criteria to identify the vulnerabilities of a web system, including 7 key items:

• Authentication management: Avoid vulnerabilities that cause account loss
• Login session management: Avoid vulnerabilities that hijack the control of login
• Decentralization: Avoid vulnerabilities that allow unauthorized functions to be performed
• Interaction with back-end: Avoid vulnerabilities that cause data loss
• Input data control: Keep information security for data that is sent to server
• Output data control: Keep information security for users
• Control of 1-day vulnerabilities of libraries and framework

Award: Over the past years, Viettel’s staff and experts have made constant efforts in the process of research and development of the most optimal products to serve for clients’ information security across the country and other clients in the region. During its operations, Viettel Group has researched and owned 50 zero-day vulnerabilities on various application platforms such as: Microsoſt, Zimbra, Facebook, Paypal, etc…

Thanks to important results in detecting vulnerabilities of popularly used various applications in the world, Viettel Group has been recognized as an excellent unit in the field of Information Security Audit, Supervision and Assurance.