Infrastructure Penetration Testing
Take Control Of Your Risk
Physical, Virtual, Cloud, Service, it's all the same to the hacker. It's infrastructure whether you own it, rent it, or share it with a thousand other organisations. Whether it's on your site or in someone else datacentre, any security weakness in it means your users, your data, and your business is at risk. Sometimes just one significant vulnerability is all it takes to destroy your reputation, your customers trust, and your business. Strong Information Security requires a firm foundation. Infrastructure is that foundation. Take control of your risk.
External Penetration Testing
External Penetration Testing is where most organisations get their first chance to see what the attacker sees when he targets their network. By the time your External Penetration Test starts, you should have properly configured your Firewalls, patched and hardened your services, and disabled non-essential network entry-points. An External Penetration Test will uncover the remaining vulnerabilities, assess the risk posed by each, and suggest steps to mitigate or eliminate those risks. Regular testing of your network perimeter is advisable as new vulnerabilities are being uncovered in Operating Systems and applications every day. There vulnerabilities pose a risk to your information assets wherever and whatever they are.
Internal Penetration Testing
Internal Penetration Tests address the problem of both the insider threat and the possibility that hackers may already be operating within your networks. Some attacks, whether from criminals, terrorists or competitors seeking a business advantage, may rely upon the co-operation of an insider. It could be an employee or a contract worker who has authorised access. You may have a disgruntled or corrupt staff member. Are your internal systems well secured against these threats? An Internal Penetration Test will uncover and explain any vulnerabilities and tell you how to go about fixing them.
Wireless Penetration Testing
Enterprise Wireless networks increase productivity of employees, reduce mobile telephony costs, and make supporting dynamic working environments easier. However wireless cannot be physically protected, as such it can be vulnerable to many different attack vectors. Wireless testing addresses this and highlights configuration, design or deployment problems with your network and the products it is built upon.
Firewall Configuration Review
Firewalls have evolved from simple packet filters and bastion hosts to large complex products deployed as a Unified Threat Management device or multi-host, multi-instance installations. Perimeter Firewalls are a vital part of any network security strategy. However, with complexity comes risk of failure, either through misconfiguration, bugs, or inadequate maintenance regime. Automatic rule wizards can make your security policy less clear and lead to unintended consequences, old rules may be left in place, rule documentation may be non-existent, temporary rules are forgotten, and functions attributed to one IP address can change over time. New vulnerabilities and exploits are created which may require fine tuning of your Firewall in order to maintain security. A Firewall configuration review will ensure that your investment in Firewall technology is protected and continues to deliver value to your organisation.
VPNs are more important now than ever. With more remote workers, more services in the cloud, and greater geographic distribution of information assets, they provide strong security and privacy for your data. However VPNs aren't immune to attack. New weaknesses and exploits are being discovered all the time. Whether you are using SSL, IPSEC, MPLS, or any other VPN technology, are you sure that it is configured in accordance with today's threats in mind? Have you updated your systems to resist advances in cryptography, or VPN protocol weaknesses uncovered since their installation? A VPN assessment will enable you to remain confidant that your confidential information stays that way.
Host Security Assessment
If you have a system at high risk of compromise from criminals, industrial spies, or hacktivists, we can analyse every aspect of that system to ensure it is as resistant as possible to attack. Typically this might be a system that has to be exposed on the network and that performs a critical or high profile function. We conduct comprehensive patch analysis, kernel vulnerability review, application assessment, and make countermeasure recommendations. If the system is 24-7 then you may want to follow up with our in-place hardening services, once the scope of improvements are agreed.
Application Penetration Testing
Find Security Flaws In Your Application Before A Hacker Does
National Institute of Standard and Technology (NIST) data has shown that it is 30x more expensive to fix security flaws in an application post-release, than during the design phase. Others put that number closer to 150x. Regardless, we know that the sooner security flaws are detected the less costly they are to fix. According to the Software Engineering Institute, security should be 15% of your application development budget. If you haven't made that investment, or haven't made it wisely, it is likely there are some serious security problems with your application. Are you confident that you have security baked-in to your development process? Do you adhere to the Software Assurance Maturity Mode (SAMM)? If you don't follow a Secure Software Development Lifecycle (SSDL) then sooner or later you will discover that application security is a pay-now or pay-much-more-later problem. The sooner you start addressing it the better.
Application Security Assessment
Application Security Assessments or Web Application Penetration Tests as they are sometimes called, seek to identify security vulnerabilities in your application before it is exposed to end users or the Internet. Ideally your organisation will have been following SAMM, SSDL, or another similar secure development process and will now be ready for this final acid test. The Application Security Assessment will uncover security problems that slipped through in development. If you haven't made sure that security is baked-in then this kind of penetration test is now the only thing standing between your application and the hacker. Depending on how mature your application development process is, and whether you have had the application tested in the past, one or more different kinds of assessment may be appropriate. We are able to undertake the full range of tests including source code static analysis and protocol fuzzing.
Applied Threat Modelling
Threat Modelling is Information Security's Realpolitik
Threat modelling is an activity based on the notion that any system or organisation has assets of value worth protecting, these assets have certain vulnerabilities, internal or external threats exploit these vulnerabilities in order to cause damage to the assets, and appropriate security countermeasures exist that mitigate the threats. It is a concept borrowed from the military. An application or system developed with threat modelling in mind, is one coded defensively, where modes of failure are considered, and controls always fail-safe. Threat Modelling is often conducted as an exercise after you have comprehensively implemented conventional Information Security doctrine.
Applied Threat Modelling
Our Applied Threat Modelling exercise starts with a meeting with senior management about what they perceive as strategic threats to their organisation. After that meeting has taken place, we convene a workshop with the IT managers to discuss the practicalities of how IT is arranged and operated and how it may be exploited by a hostile actor. During this workshop we gain an understanding of the security measures and procedures in-place and begin to identify potential weakness. We then research and construct a number of realistic and specific attack scenarios. These attacks are documented and the IT staff are given an opportunity to consider if they would be detected and countered. Finally we determine what tactical and strategic changes the organisation can make to reduce the risk of such attacks succeeding. Recommendations may include changes to policy, procedure, personnel, and technology. The output from this exercise often forms part of budget justification for improving processes and technology, or replacing or expanding technical staff. In some cases it provides impetus to transform Information Security Management within an organisation.
One Of The Most Serious Threats An Organisation Faces
Social engineering is a non-technical method of intrusion that relies heavily on human interaction and often involves tricking people into breaking normal security procedures. It refers to psychological manipulation of people, getting them to perform actions or divulge confidential information. It is a type of confidence trick used for the purpose of information gathering, fraud, or system access, it differs from a traditional "con" in that it is often one of many steps in a more complex fraud. Social Engineering has become popular because it is often easier for an attacker to trick your staff into providing him with access and information, than it is to defeat technical measures you have put in place. It is one of the greatest threats that organisations face.
Social Engineering Test
It is possible to reduce the chances of falling victim to Social Engineering attack. Although the odds look bad for the defender since an attacker may try multiple times against one target, that attacker need only raise suspicions once for the defender to pull down the shutters and raise the alarm. A Social Engineering penetration test or assessment will tell you how susceptible your staff, protocols, and technology are to this form of attack. Once you are aware of your weaknesses you can then begin a program of fixing them. We are able to undertake all forms of Social Engineering assessment, including on-site activities. Our findings and recommendations for improvements are then presented to you in the form of a report and optional briefing.