One of the key steps to measure operational risk is the need to understand where you are vulnerable to an attack, and where you may have already been compromised.
The value and benefits for undertaking penetration tests and security assessments include:
- Policy mandate to undertake periodic testing - All of the security standards and industry regulations advocate testing.
- Identifying exploitable conditions before they can become a security breach (Prevention rather than panic!)
- Acceptance of a new system in regards to its security strengths
- Validate that a previously discovered exploit has been adequately closed.
- Ad hoc (sanity) check to measure if security precautions are fit for purpose.
- Meeting and demonstrating Compliance & Audit directives.
Read more about Penetration Testing - the what, when, why and who here.
Service Offering
- External Penetration Testing: Sometimes referred to as infrastructure testing, encompasses the testing of public facing systems, such as firewalls, DMZ’s hosts and VPN access.
- Internal Host & Wifi: testing the Desktop, Server, and Network addressable hosts for exploitable conditions and build strength. Ensuring wifi access cannot be compromised or abused.
- Stolen Laptop: taking a representative laptop or mobile device and testing as if lost or stolen. The objective is to quantify if access to the stored data is permissible, and if the device can be used to invoke a remote access connection to the network.
- VOIP Assessment: Can the VoIP node be compromised for unauthorised usage, and is the VoIP ingress route vulnerable to an external attack.
- Website & Web App Testing: testing the native web apps, the web host system for resistance to an attack encompassing cross site scripting, backend database and legacy system integrity.
- APT (Advanced Persistent Threat) Assessment: APT’s by their nature can be missed by antivirus software. This assessment captures network traffic over a few weeks and analyses for botnets, remote access trojans and zero day threats.
- Phishing Simulation: Creating a series of bespoke emails and web servers to measure how perceptible staff would be to divulging sensitive information via such an attack.
- Social Engineering: testing if the physical perimeters are open to access, for instance by shoulder surfing, bravado and deceiving reception staff. And/or misleading staff via the telephone into disclosing sensitive information, such as password resets.
- Active Directory Assessment: AD analysis for security, misconfigurations, resource access rights, passwords, stale accounts, roles and administrator privileges.
- Cyber “V” (visibility) assessment: Reviewing and analysis against the top 20 advocated controls and good practises which make for a robust Cyber Security.
- Information Risk Audit: Identifying and locating how and where sensitive information is being passed, stored and distributed. Equating the risk of accidental or malicious disclosure.
Information Request and Opinion
Complete the short form if you would like to know more; we would be happy to arrange an informal time with one of our consultants for a more in-depth discussion.
Penetration (Pen) Testing is a specialised discipline that encompasses a lot more than simply running a Vulnerability Assessment (VA) tool. Pen tests should follow formal procedures, use a multitude of scan tools and more importantly be undertaken by experienced engineers who can interpret the Vulnerability Assessment results to create stronger cascading attack scenarios. The test should also be undertaken by staff independent of any other function to ensure the tester provide objective and impartial reports.
Nigel Lewis
