Pen Test and Load Test for a Startup
Discussion
We have a website that has a potential user base of millions (whether we achieve this is a separate discussion).
We need to have it security/pen tested and load tested too.
Most suppliers of these services seem to target big corporations. Does anyone know of a company offering either of these services aimed at startups with smaller budgets?
Thanks.
We need to have it security/pen tested and load tested too.
Most suppliers of these services seem to target big corporations. Does anyone know of a company offering either of these services aimed at startups with smaller budgets?
Thanks.
Load testing is my day job although as an internal rather than external service.
It might be worth having a chat with one of the following companies:
https://www.qualitestgroup.com/
https://www.blazemeter.com/
https://gatling.io/consulting-and-training/
As a general principle for most web applications such as ecommerce sites or data collection / management, do *NOT* underestimate the scale of the problem facing you by starting from scratch.
There's a lot of work and thinking involved around to name a few:
1) What your objectives are (One-off assurance? Baseline benchmarking? Critical scenarios e.g. Black Friday-type events?)
2) Understanding your user journeys and typical behaviours (everyone straight through or do they spend time hitting the search constantly?
3) Creating test scripts for scenarios along with associated data artefacts and assets.
4) Provisioning either comparative or scaled test environments to test against and making sure that they functionally hang together before running things at high volume load.
5) Running at least 5-10 test cycles with increasing duration and volumes with the expectation that most of the early ones will fail really quickly, due to either environmental or test script issues e.g. not enough database connection configured. This happens pretty much every time as most people either leave the default configuration values or pick a number because "That'll do". Sometimes having too much configured can cause you more problems than having too little as it pushes the bottlenecks further down the line than they should.
6) Time to analyse test data, generate reports, provide recommendations to fix / improve and then allowance for these to be implemented before the next test execution.
Having a potential userbase of millions is nice from an aspirational point of view but a million users who use it once in a blue moon (e.g. Autotrader) is very different from a thousand users thrashing it 12 hours a day for a month e.g. financial year end. It's always good to look at your business projections along with your existing usage patterns and align those with your objectives in 1) above e.g. "It's doing ok on a daily basis but I want to be assured that if I push this marketing campaign, the website will cope."
It might be worth having a chat with one of the following companies:
https://www.qualitestgroup.com/
https://www.blazemeter.com/
https://gatling.io/consulting-and-training/
As a general principle for most web applications such as ecommerce sites or data collection / management, do *NOT* underestimate the scale of the problem facing you by starting from scratch.
There's a lot of work and thinking involved around to name a few:
1) What your objectives are (One-off assurance? Baseline benchmarking? Critical scenarios e.g. Black Friday-type events?)
2) Understanding your user journeys and typical behaviours (everyone straight through or do they spend time hitting the search constantly?
3) Creating test scripts for scenarios along with associated data artefacts and assets.
4) Provisioning either comparative or scaled test environments to test against and making sure that they functionally hang together before running things at high volume load.
5) Running at least 5-10 test cycles with increasing duration and volumes with the expectation that most of the early ones will fail really quickly, due to either environmental or test script issues e.g. not enough database connection configured. This happens pretty much every time as most people either leave the default configuration values or pick a number because "That'll do". Sometimes having too much configured can cause you more problems than having too little as it pushes the bottlenecks further down the line than they should.
6) Time to analyse test data, generate reports, provide recommendations to fix / improve and then allowance for these to be implemented before the next test execution.
Having a potential userbase of millions is nice from an aspirational point of view but a million users who use it once in a blue moon (e.g. Autotrader) is very different from a thousand users thrashing it 12 hours a day for a month e.g. financial year end. It's always good to look at your business projections along with your existing usage patterns and align those with your objectives in 1) above e.g. "It's doing ok on a daily basis but I want to be assured that if I push this marketing campaign, the website will cope."
Edited by eltawater on Monday 25th March 14:31
From a web app pen test/assurance perspective the costs aren’t going to vary wildly against a given spec. It’s reasonably commodity work (although arguably it shouldn’t be treated as such!). You do need to work out what you want from the test.
There are lots of companies out there who have quality people. I really rate ContextIS after using them on some simple and some very complex work. Pentest Partners are good as are MWR. NCC can be good but quite dependent on individuals (same applies with any other firm).
There are lots of companies out there who have quality people. I really rate ContextIS after using them on some simple and some very complex work. Pentest Partners are good as are MWR. NCC can be good but quite dependent on individuals (same applies with any other firm).
We are seeing the need for Pen testing penetrate down (excuse the pun) to the SMB space. We see this driven by 3 main factors. GDPR, Client requirements, and the very real risks caused by cyber crime to SMB's.
As a result, there are more and more Pen testers who focus on the SMB space, though it can be tricky to find them/one you trust.
We can assist, but I have put that in a PM, so as not to turn this into a pitch.
As a result, there are more and more Pen testers who focus on the SMB space, though it can be tricky to find them/one you trust.
We can assist, but I have put that in a PM, so as not to turn this into a pitch.
I used to deliver pentesting for PwC, NCC, etc. and have been head of testing for a global conglomerate.
Here is a list for the UK;
https://www.crest-approved.org/accredited-companie...
Don't use anyone not crest certified, it's a badge of accreditation - and requires extensive examination.
Here is a list for the UK;
https://www.crest-approved.org/accredited-companie...
Don't use anyone not crest certified, it's a badge of accreditation - and requires extensive examination.
XJ75 said:
We have a website that has a potential user base of millions (whether we achieve this is a separate discussion).
We need to have it security/pen tested and load tested too.
Most suppliers of these services seem to target big corporations. Does anyone know of a company offering either of these services aimed at startups with smaller budgets?
Thanks.
Is this ecommerce ? if so then using Shopify (sass) negates nearly all the above. If not then sorry not a clue. We need to have it security/pen tested and load tested too.
Most suppliers of these services seem to target big corporations. Does anyone know of a company offering either of these services aimed at startups with smaller budgets?
Thanks.
Gassing Station | Business | Top of Page | What's New | My Stuff