#ikdoeict pentest, 2020 edition

This article originally appeared in December 2020 on rlvs.eu.

It is becoming somewhat of a tradition. This year, as part of the data security course, our 3ICT students were once again asked to each contact a website and subsequently audit its security. This comes with no obligation of results, as it remains an exercise, and naturally, no two students are alike.

We have good students, but also really good and, well, even better students. 😄

Not on our site

Finding willing website owners isn’t easy for students. A mix of hesitation and fear often leaves our students turned away during their search, unfortunately not always with the best arguments…

“Our site cannot be tested because we know there are security issues…”

Anonymous company 1

“Our site is in production, but still under development. So we’d prefer no tests…”

Anonymous company 2

Of course, our thanks go out to the 60 website owners who were willing to let us scrutinize their site this year.

Why test

For our students, performing a pentest is the ideal application of the data security theory they’ve learned so far. This way, the next generation of developers and sysadmins learns about the biggest security pitfalls. The OWASP Top Ten is used as a guideline for the audit.

For anyone hesitating over whether to have their site tested: just do it! It fits perfectly into a company’s GDPR policy, it can be done free of charge by our students, and it keeps your developers sharp. For more and more companies, it is even mandatory to comply with guidelines or legislation they are subject to.

The test results (which ran until Nov 29) are coming in, and it’s clear that for several company websites, this test will mean the difference between making the news with an embarrassing data breach or not.

But I’m getting ahead of myself for a future blog post, featuring a summary of the anonymized results…