Penetration Testing Services

Identify weaknesses and vulnerabilities before hackers or bots do.

Overview

What is Penetration Testing?

A method for gaining assurance in the security of an IT system by attempting to breach some or all of that system’s security, using the same tools and techniques as an adversary might.

Penetration testing should be viewed as a method for gaining assurance in your organisation’s vulnerability assessment and management processes, not as a primary method for identifying vulnerabilities.

A penetration test should be thought of as similar to a financial audit. Your finance team tracks expenditure and income day to day. An audit by an external group ensures that your internal team’s processes are sufficient.

The Types of Penetration Testing We Offer

  • Phishing Assessment
  • Wi-Fi Security Assessment
  • Remote Security Assessment
  • Social Engineering Assessment
  • Network Penetration Test
  • Application Assessment
  • API Assessment

Phishing Assessment

In Phishing, targeted attacks are made to a user’s Email and Phone system. In a Phishing Assessment, these targeted attacks are made in much the same way as one might expect to find them in the real world, but they originate from a trusted source in a safe environment. This means that you can detect who of your colleagues needs training in order to recognize a phishing attack so that you can prevent a real breach.

Wi-Fi Security Assessment

This is performed on-site. A member of our team would attempt to exploit vulnerabilities within any of the wireless networks used by your organization. If successful, an attacker may be able to gain access to your internal network, gathering additional means of extracting information or even being able to gain direct access to sensitive material. The results of the Wireless Security Assessment are then shared with you, and steps to remedy the situation are suggested.

Remote Security Assessment

Remote access solutions, such as VPNs are used by organisations to provide staff remote access to the network. However, this added flexibility of remote services is exploited by attackers who generate lists of common usernames and passwords, seeking entry to your network. By using automated and manual tools, our team of Penetration Testers identify vulnerabilities and provide you with a suitable remediation plan to make your remote access solutions more secure.

Social Engineering Assessment

In the IT Security world, Social Engineering is when people directly pose to be someone other than they are. They use uncertainty within staff as an advantage to gain access to sensitive information, such as passwords or usernames, or even direct access to your machines, which can then be used in turn as a stepping-stone to even more sensitive data. In this test, your staff may directly be tested in their responsiveness to unknown individuals attempting to physically enter a site.

Network Penetration Test

As the names imply, an internal assessment evaluates the security of your company’s Internal Networks, used solely by staff or other employees, whereas an external assessment focuses on the external networks that are available to the general public.

Application Assessment

An application assessment targets the common vulnerabilities in traditional web applications. Attackers often exploit these vulnerabilities to gain access to personal user information or deface a website and cause general disruption or denial of service (DDoS Attacks).

API Assessment

An Application Programming Interface (API) Test is centered upon the attacks that can be made directly through the internet. Targeting beyond the front end.

What Should a Penetration Test Tell You?

Typically, penetration tests are used to identify the level of technical risk emanating from software and hardware vulnerabilities. Exactly what techniques are used, what targets are allowed, how much knowledge of the system is given to the testers beforehand and how much knowledge of the test is given to system administrators can vary within the same test regime.

A well scoped penetration test can give confidence that the products and security controls tested have been configured in accordance with good practice and that there are no common or publicly known vulnerabilities in the tested components, at the time of the test.

Why Does Your Business Need Penetration Testing?

The most important times to perform a penetration test are when:

  • You’ve recently made changes to your infrastructure.
  • You’ve recently undergone a merger or acquisition.
  • You’re looking to comply with Security Standards.
  • You’re launching new services or applications.
  • You’re bidding on new commercial contracts.
  • You’ve not performed any Penetration Testing recently.

Using Penetration Testing Effectively

A penetration test can only validate that your organisation’s IT systems are not vulnerable to known issues on the day of the test.

It’s not uncommon for a year or more to elapse between penetration tests. So, vulnerabilities could exist for long periods of time without you knowing about them if this is your only means of validating security.

How Often Do You Really Need to Penetration Test?

The standard recommendation for a Penetration Test is yearly due to the increasing number of threats and methods attackers have access to; however, it can be as often as monthly if circumstances require.

What is Vulnerability Scanning?

Vulnerability scanning is a broad term, used to describe the automated process of detecting defects in an organisation’s security program. This covers areas such as the patch management process, hardening procedures, and the software development lifecycle (SDLC).

Standard Penetration vs Continuous Penetration Testing

Standard Penetration

A review of your network at a single moment in time and provides coverage of your current position. It uses both automated and human creativity to review methods to gain access to your network.

Continuous Penetration

An automated software that prevents a user or team from publishing mistakes in configuration or coding that could be exploited by attackers.

Common Security Vulnerabilities Identified in a Penetration Test

  • Configuration: This is the human error test affecting entry points.
  • Encryption: Ensure encryption methods to prevent data in transit from being tampered.
  • Programming: This examines software source code for flaws.
  • Session Management: Testing for vulnerabilities in session tokens.

The Core Stages of a Penetration Test

1. Scoping

Together we define the expectations and requirements.

2. Order

You confirm the agreement and authorise the necessary paperwork.

3. Testing

Testing takes place on the agreed days.

4. Reports

After the work is done, relevant reports are generated.

5. Remediation

The client is responsible for implementing suggested changes.

Frequently Asked Questions (FAQs)

  1. How often should a Penetration Test be performed? As often as necessary based on infrastructure changes.
  2. How long does a Penetration Test usually take? From a few days to three to four weeks.
  3. How much does a Penetration Test Cost? Varies by network size and testing package.
  4. Can a Penetration Test be performed remotely? Yes, some parts can be remote.
  5. What happens once the Penetration Test is complete? Reports include discovered issues and remediation advice.
  6. Who Performs the Penetration Test? Conducted by CREST accredited partners.