Data Protection & Security

Data protection and cybersecurity have now become fundamental concepts of every business, and they are even more so when it comes to sensitive data, i.e. personal data whose collection and processing are subject to both the consent of the interested party and the preventive authorization of the Privacy Guarantor. Following the security best practices in the implementation of a service or a platform that collects sensitive data is certainly a good starting point, but it may not be enough. In fact, it is necessary to thoroughly test the response of a computer system (identified as a target) to a series of targeted attacks with the aim of maliciously exfiltrating confidential information, and reliably certify that the system is robust and responsive to intrusion attempts by ‘external. The operational process of analyzing, evaluating and attempting to exploit a system’s vulnerabilities is called penetration testing. The testing activities cannot fail to be accompanied by a detailed reporting activity, which highlights which tests have been carried out, the details of the results obtained and whether and which vulnerabilities have been exploited to access and manipulate the target information system.