With your business systems connected to the Internet and the ever-increasing news about companies having their data breached, it’s only a matter of time until your business assets are targeted.
Network penetration testing is used to identify existing risks and cyber security-related vulnerabilities, you need to bring in an expert.
Our bespoke approach blends a mixture of technical and social assessments to give businesses a true understanding of their cyber risk.
Approach
InfoSec Governance’s penetration testing service utilises a comprehensive standardised, risk-based approach to manually identifying critical vulnerabilities that exist on all in-scope applications. Our approach is made up of the following steps:
- Information Gathering
- Threat Modelling
- Vulnerability Analysis
- Exploitation
- Privilege Escalation
- Reporting
Using an industry-standard approach, InfoSec Governance’s comprehensive method of testing involves the use of ‘Open Source Security Testing Methodology Manual‘ (OSSTMM) as well as ‘Passive Reconnaissance, Open Source Intelligence’ (OSINT), Active Reconnaissance (possible use of onsite covert observation etc), vulnerability identification and exploitation and more…
Tools
In order to perform comprehensive real-world Network Penetration Testing, InfoSec Governance utilises a mixture of commercial and open-source tools used by malicious hackers. As penetration testers, we assess systems by simulating a real-world attack and leveraging the many tools at our disposal to effectively carry out that task.
Reporting
We consider the reporting phase to mark the beginning of our relationship. InfoSec Governance strives to provide the best possible customer experience and service.
Remediation & Re-testing
Our objective is to help businesses fix vulnerabilities, not just find them. As a result, remediation re-testing is always provided at no additional cost.
Methodology
Each and every web application penetration testing is conducted consistently using industry standard frameworks, in order to ensure a sound and comprehensive penetration test. At a minimum, the underlying framework is based upon OSSTMM but goes beyond the initial framework itself.
Passive Reconnaissance
The first phase in a physical penetration test is focused upon collecting as much information as possible about the target. Passive reconnaissance, otherwise known as information gathering, is one of the most important steps of Network Penetration Testing. This is done through the use of public tools, such as Google and DNS records. As a result, it is usually possible to learn a great deal about the target’s surroundings and environment.
Open Source Intelligence
An important phase in a penetration test focuses upon collecting as much information as possible that is freely available. Open Source Intelligence Gathering can be quite telling about a target. This type of information gathering is done through the use of social networks, job boards, etc. Through thorough analysis, it helps to paint a picture of the target and its primary operations.
Active Reconnaissance
Active reconnaissance in Network Penetration Testing involves gathering information offline: this type of test starts to interact with the target.
Covert Observation
Covert observation is exactly what it sounds like: this includes covert photography of the target up close in an effort to identify physical security controls and monitoring staff as they are coming and going.
Infiltration, Exploitation & Post-Exploitation
During these phases, InfoSec Governance security consultants carry out the plan by exploiting vulnerabilities discovered using information and intelligence captured during the earlier phases of the assessment. Post-exploitation involves penetrating further into the environment and setting up to maintain a persistent backdoor. Deliverables
Here at InfoSec Governance, we consider the delivery and reporting phase of the test to be the most important piece and we take great care to ensure we’ve communicated the value of our service and findings thoroughly. The deliverables consist of a report that includes several key components including, but not limited to: Executive Summary, Scope, Findings, Evidence, Tools and Methodology.
Findings are communicated via email; however, they can be presented in-person or virtually via Skype or Google Hangouts – whichever medium is most conducive for communicating results effectively. During this time, TeraByte consultants will walk through the report, in detail, to ensure all findings and their corresponding description, risk rating, impact, likelihood, evidence and remediation steps are thoroughly understood.
While this typically involves a single meeting, there is no limit to how many may be needed. The key underlying message is that all information is clearly understood and that a roadmap toward remediation/mitigation is crystal clear.
Components
Some of the key components to our physical penetration test deliverable include, but are not limited to:
- Scope
- Control Framework (ie: OWASP, PCI, PTES, OSSTMM)
- Timeline
- Executive Summary Narrative
- Technical Summary Narrative
- Report Summary Graphs
- Summary of Findings
- Findings (Description, Business Impact, Recommendation, Evidence, References, CVSS, Risk Rating Calculation)
- Methodology and Approach
- Risk Rating Factors
- Tools
