A Conversation with Romeo Mungiu, Cybersecurity Technical Lead at CyberSA<\/p>\n\n\n\n
Romeo, what does conducting a Penetration Test mean to you?<\/strong> What experiences have impacted you the most in your work?<\/strong> Is a Penetration Test Just About Finding Vulnerabilities?<\/strong> How Do You See the Future of Penetration Testing?<\/strong> Can you give us one last piece of advice?<\/strong> Una conversazione con Romeo Mungiu, Cybersecurity Technical Lead di CyberSA Romeo, cosa significa per te fare un Penetration Test?Fare un Penetration Test \u00e8 come giocare una partita a scacchi, solo che l\u2019avversario \u00e8 invisibile e le regole cambiano continuamente!In CyberSA, quando eseguiamo un test, non ci limitiamo a usare tool standard o seguire checklist. Pensiamo […]<\/p>\n","protected":false},"author":2,"featured_media":134,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17],"tags":[18,16],"class_list":["post-59","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-prodotti","tag-penetration-test","tag-prodotti"],"featured_image_url":{"thumbnail":"https:\/\/www.cybersa.it\/wp-content\/uploads\/2024\/10\/image-2-150x150.jpg","medium":"https:\/\/www.cybersa.it\/wp-content\/uploads\/2024\/10\/image-2-300x200.jpg","medium_large":"https:\/\/www.cybersa.it\/wp-content\/uploads\/2024\/10\/image-2-768x511.jpg","large":"https:\/\/www.cybersa.it\/wp-content\/uploads\/2024\/10\/image-2-1024x682.jpg","1536x1536":"https:\/\/www.cybersa.it\/wp-content\/uploads\/2024\/10\/image-2.jpg","2048x2048":"https:\/\/www.cybersa.it\/wp-content\/uploads\/2024\/10\/image-2.jpg","trp-custom-language-flag":"https:\/\/www.cybersa.it\/wp-content\/uploads\/2024\/10\/image-2.jpg"},"post_author":"Romeo Mungiu","assigned_categories":"Prodotti","_links":{"self":[{"href":"https:\/\/www.cybersa.it\/en\/wp-json\/wp\/v2\/posts\/59","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cybersa.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cybersa.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cybersa.it\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cybersa.it\/en\/wp-json\/wp\/v2\/comments?post=59"}],"version-history":[{"count":2,"href":"https:\/\/www.cybersa.it\/en\/wp-json\/wp\/v2\/posts\/59\/revisions"}],"predecessor-version":[{"id":522,"href":"https:\/\/www.cybersa.it\/en\/wp-json\/wp\/v2\/posts\/59\/revisions\/522"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cybersa.it\/en\/wp-json\/wp\/v2\/media\/134"}],"wp:attachment":[{"href":"https:\/\/www.cybersa.it\/en\/wp-json\/wp\/v2\/media?parent=59"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cybersa.it\/en\/wp-json\/wp\/v2\/categories?post=59"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cybersa.it\/en\/wp-json\/wp\/v2\/tags?post=59"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Conducting a Penetration Test is like playing a game of chess, except the opponent is invisible and the rules are constantly changing!
At CyberSA, when we conduct a test, we don\u2019t just use standard tools or follow checklists. We think like attackers, putting ourselves in the shoes of those who might want to exploit a vulnerability. Each test is an opportunity to challenge not only the infrastructure but also ourselves.<\/p>\n\n\n\n
Well, over the years, I\u2019ve seen it all.
From the gaming industry, with massive servers and stringent security levels, to critical infrastructures where, for example, an update can require weeks of planning. I\u2019ve worked in healthcare environments where every Bluetooth device can pose a risk, and in small companies where the development teams\u2019 passion is so strong that you find original solutions at every corner.
But what always leaves a lasting impression on me is the importance of our work!
We\u2019ve stolen credentials, compromised domain controllers, exfiltrated data, and every time I wonder: \u2018What would happen if this attack were real?\"
It\u2019s an enormous responsibility, but also a fascinating challenge.<\/p>\n\n\n\n
Absolutely not!
Identifying vulnerabilities is just the starting point. The truly crucial part is understanding which vulnerabilities can have a significant impact and, most importantly, clearly explaining to the client how to resolve them. Every infrastructure is different, and each vulnerability can pose unique risks. Our job doesn\u2019t end when we find a problem; that\u2019s when the most important part begins: helping the client solve that problem.<\/p>\n\n\n\n
It\u2019s a constantly evolving world.
With regulations like NIS2 and DORA, we will see more and more sectors forced to implement tests they previously did not consider. And then there are new technologies: with the arrival of LLMs, we expect to face completely new challenges, such as prompt injection. The threat landscape is not static, and that is why we as penetration testers must always stay one step ahead of the attackers!<\/p>\n\n\n\n
A Penetration Test is never a \u201cone and done\u201d process.
Threats evolve, just as infrastructures do.
My advice is simple: never underestimate the importance of regular testing.
Only this way can we truly prevent attacks and protect what matters most!<\/p>","protected":false},"excerpt":{"rendered":"