Penetration testing is the practice of testing computer systems, networks, and web-applications to find vulnerabilities that attackers could exploit.
WHAT IS PENETRATION TESTING?
A penetration test is an information security assessment which simulates an attack against an organisation’s IT assets.
The ‘Red Team’ (ethical hackers) examine your IT systems for any weaknesses that genuine attackers would exploit to compromise the confidentiality, availability, or integrity of the network and associated data.
We have partnered with an Informaton Security specialist to provide Penetration Testing services.
FEATURES
- Highly skilled team of ethical hackers and global security experts
- Conduct penetration test in the same way as actual malicious hackers
- Latest tools and techniques used by ethical hackers
- Not always necessary for the ethical hackers to be at your premises
- Comprehensive reporting explaining each exploitable vulnerability
- Detailed remediation and resolution steps to enhance your Cyber-Security
BENEFITS
- Provide real information on vulnerabilities within your IT infrastructure
- Compliance adherence. Certain standards and certification bodies require penetration testing
- Providing your clients and stake-holders a clear message that you take Cyber-Security seriously
- Thoroughly tests your existing Cyber-Security defence capabilities
- Offers third-party expert opinion
- Protect your reputation and brand
WHAT VALUE DO I GET FROM A PENETRATION TEST?
The penetration test will produce Technical and Management reports containing vulnerabilities, remediation steps, and guidance. This allows you to plan and prioritise any improvements to the way you process and store your data, thereby reducing your organisational risk.
Yet, whilst this is valuable in itself, there is a lot of additional value that may not be immediately obvious. For example, demonstrating a commitment to responsible and secure processes builds trust with your Clients, Partners, and regulating bodies. It shows you take your security obligations seriously.
From a commercial perspective, a penetration test can help close new business opportunities. If your customers are regulated, they may, in turn, need you to show that your products, services or environments are security tested regularly. Being able to demonstrate this as part of your negotiations may be critical to you receiving the order.
At the end of the penetration testing and remediation processes, you can be sure that we have assisted in ensuring that your business is now more aware, and cyber secure.
WHAT IS AN ETHICAL HACKER, AKA THE RED TEAM?
The Red Team can be considered the actual Pen Testers. Their primary objective/goal is to emulate the mindset of an attacker; to try and crack open all of the present weaknesses and vulnerabilities in the systems. In other words, it is the Red Team that attacks all possible fronts.
INTERNAL PEN TESTING
An Internal Penetration Test examines internal IT systems for any weaknesses that could disrupt the confidentiality, availability, or integrity of the network. The organisation can then address each weakness.
EXTERNAL PEN TESTING
An External Penetration Test examines external IP address ranges or IT systems for any weakness that could disrupt the confidentiality, availability, or integrity of the network. The organisation can then address each weakness.
THERE ARE TWO MAJOR CLASSES OF PENETRATION TEST:
‘Black box’ testing is when the Penetration Testers are not given any prior information about the target network or system. This simulates conditions in the wild, as external hackers must probe and pry at their real-life targets to discover access points and weaknesses.
This contrasts with ‘White box’ testing, where testers are provided with proprietary information such as network diagrams, passwords, application source code, IP addresses etc… in an attempt to identify existing vulnerabilities in a known configuration.
THERE ARE TWO MAJOR CLASSES OF PENETRATION TEST:
Real-world and Online Reconnaissance:
The testers search multiple sources to obtain information about your organisation
Probe for Points of Access:
The testers will try to discover ways of infiltrating your network
Attempts at Vulnerability Exploitation:
Rigorous testing using specialist software tools and methods
Brute Force Penetration Attempts:
Sustained hacking attempts of user credentials
Social Engineering Tricks:
An assortment of different techniques to obtain user credentials and information
Network Infiltration:
Testers will attempt to gain control of computers and devices on your network
Pivoting:
Having taken over a network resource, they use it as a springboard to search for other targets
Collection of Corroborating Evidence:
The testers will extract something from your network to prove they successfully gained access
Reporting:
The testers will produce full documentation of findings with recommended remediation steps
Follow up Penetration Test:
Ensures mediation steps have been implemented
