Penetration Testing and Security Audits

Whistl undergoes regular penetration testing and security audits to ensure robust protection. This technical guide explains security assessment methodology, vulnerability management, bug bounty programs, and how Whistl maintains bank-level security standards.

Why Security Testing Matters

Financial apps are high-value targets:

• Financial data: Bank accounts, transactions
• Personal information: Identity, location, behaviour
• Trust: Security breaches destroy user confidence
• Regulatory: Financial apps have strict requirements
• Continuous threats: Attackers constantly evolve

Whistl invests heavily in security testing to protect users.

Security Assessment Program

Whistl uses multiple security assessment methods:

Assessment Types

Penetration Testing

Professional pentesters attempt to breach Whistl's defences:

Pentest Scope

• Mobile applications: iOS and Android apps
• API endpoints: All REST/GraphQL APIs
• Web application: Admin dashboard, user portal
• Infrastructure: AWS, networking, databases
• Third-party integrations: Plaid, Oura, HealthKit

Testing Methodology

# OWASP Testing Guide v4 + PTES

## 1. Pre-engagement
- Define scope and rules of engagement
- Sign NDA and legal agreements
- Set up test environment

## 2. Intelligence Gathering
- Passive reconnaissance
- Active scanning
- Service enumeration

## 3. Threat Modeling
- Asset identification
- Threat agent analysis
- Attack vector mapping

## 4. Vulnerability Analysis
- Automated scanning
- Manual verification
- False positive elimination

## 5. Exploitation
- Attempt controlled exploitation
- Document impact
- Preserve evidence

## 6. Post-exploitation
- Determine access level
- Data access assessment
- Lateral movement testing

## 7. Reporting
- Executive summary
- Technical findings
- Remediation recommendations
- Risk ratings

Common Test Categories

Vulnerability Management

Discovered vulnerabilities are tracked and remediated:

Severity Classification

Remediation Workflow

1. Discovery
   └── Vulnerability found (pentest/bug bounty/scanner)
   
2. Triage
   └── Security team validates and assigns severity
   
3. Assignment
   └── Ticket created, assigned to engineering team
   
4. Remediation
   └── Fix developed, tested, reviewed
   
5. Verification
   └── Security team verifies fix
   
6. Deployment
   └── Fix deployed to production
   
7. Closure
   └── Ticket closed, lessons learned documented

Bug Bounty Program

Whistl rewards security researchers for responsible disclosure:

Program Details

• Platform: HackerOne / Bugcrowd
• Scope: Mobile apps, APIs, web application
• Rewards: $100 - $10,000 based on severity
• Eligibility: Worldwide (excluding sanctioned countries)
• Response time: 48 hours for initial response

Reward Tiers

Out of Scope

• Social engineering of employees (unless authorized)
• Physical attacks on offices/data centres
• DDoS attacks
• Spam or phishing
• Previously known vulnerabilities (CVE with patch available)
• Theoretical vulnerabilities without proof of exploit

Security Code Review

All code is reviewed for security issues:

Review Process

# Pull Request Security Checklist

## Authentication & Authorization
- [ ] Proper authentication required
- [ ] Authorization checks in place
- [ ] No hardcoded credentials
- [ ] Session management secure

## Input Validation
- [ ] All inputs validated
- [ ] SQL queries parameterized
- [ ] Output encoded (XSS prevention)
- [ ] File uploads validated

## Data Protection
- [ ] Sensitive data encrypted
- [ ] No sensitive data in logs
- [ ] Secure random generation
- [ ] Proper key management

## Error Handling
- [ ] No stack traces exposed
- [ ] Generic error messages
- [ ] Proper logging for debugging

## Dependencies
- [ ] No known vulnerable versions
- [ ] Dependencies from trusted sources
- [ ] License compliance checked

Static Analysis

Automated tools scan code for vulnerabilities:

Tools Used

Dynamic Analysis

Running applications are tested for vulnerabilities:

DAST Tools

• OWASP ZAP: Automated scanning of web APIs
• Burp Suite Enterprise: Comprehensive web testing
• Nuclei: Template-based vulnerability scanning
• SQLMap: SQL injection testing

Infrastructure Security

AWS infrastructure is regularly audited:

AWS Security Services

• AWS Security Hub: Centralized security view
• AWS GuardDuty: Threat detection
• AWS Inspector: Vulnerability scanning
• AWS Config: Configuration compliance
• AWS CloudTrail: API activity logging

Compliance Frameworks

• SOC 2 Type II: Annual audit
• ISO 27001: Information security management
• PCI DSS: Payment card handling (if applicable)
• Australian Privacy Principles: Privacy compliance

Incident Response

Security incidents are handled systematically:

Response Team

• Security Lead: Incident commander
• Engineering: Technical remediation
• Legal: Regulatory compliance
• Communications: External messaging
• Support: User communication

Response Process

1. Identification: Detect and confirm incident
2. Containment: Limit damage
3. Eradication: Remove threat
4. Recovery: Restore normal operations
5. Lessons Learned: Document and improve

Security Metrics

Security posture is continuously measured:

Key Metrics

Conclusion

Whistl maintains bank-level security through regular penetration testing, comprehensive vulnerability management, and a robust bug bounty program. Security is not a one-time achievement but a continuous commitment to protecting user data.

Every vulnerability discovered and fixed makes Whistl safer for everyone.

Related: Local Storage Encryption | Plaid Bank Integration Security | API Rate Limiting