Penetration testing and red team assessments are a critical part of a robust security program. Perhaps the best way to know if something can be hacked is to hire a trustworthy, expert hacker to break in. This approach has many benefits:

• Evidence – Security testing deliverables should include clear evidence of each vulnerability (including screenshots) and steps to reproduce. It is a human instinct to question the veracity of bad news, and clear evidence can help organizations move from debate to action.
• Discovery – Security testing often discovers vulnerabilities of which the organization was previously unaware.
• Remediation – The vulnerabilities discovered during testing can be remediated, and the organization’s security posture can be improved.
• Impact – In sophisticated red team assessments, testers show the potential impact to the business of exploiting vulnerabilities, from money movement to intellectual property theft. A demonstration of impact can motivate an organization to allocate necessary security budget, reprioritize efforts, and support difficult changes to prevent a real adversary from succeeding.
• Incident Response – Red team assessments can also test an organization’s incident response processes and identify gaps that can allow detected attackers to retain access.
• Preparation – Threat actors are collecting record-breaking financial rewards from hacking activity and are thus more motivated than ever before. If your organization has money, attackers want it, and will try to find a way to get it. The attacks are happening now, and it behooves all organizations to test their own attack surface and prepare.

Selecting Testing Types

Many blockchain projects are unique or have unusual characteristics, which means that there is no one-size-fits-all approach to testing blockchain applications. Each blockchain testing project must be customized. A typical Web3 penetration test will include some, but not all, of the following tests:

• Red Team Assessment
• Application Penetration Test
• Smart Contract Audit
• Blockchain Node Penetration Test
• Cryptocurrency Wallet Penetration Test
• DevOps Penetration Test

The following flowchart provides guidance on which of these six tests to include in a complete penetration test, based upon the characteristics of the blockchain project.