Penetration testing, also referred to as pen testing, is a simulated real world attack on a network, application, or system that identifies vulnerabilities and weaknesses. Penetration tests (pen tests) are part of an industry recognised approach to identifying and quantifying risk. They actively attempt to ‘exploit’ vulnerabilities and exposures in a company’s infrastructure, applications, people and processes. Through exploitation, Tek Secure is able to provide context around the vulnerability, impact, threat and the likelihood of a breach in an information asset.
It is frequently possible for a pen tester to gain remote access to operating systems, application logic and database records. Through active exploitation of direct and interconnected systems, Tek Secure can provide strategic guidance on risk and tailored advice on counter measures.
Manage your risk– A penetration test identifies vulnerabilities in your environment and allows you to remediate them, before an adversary takes advantage of them.
Protects clients, partners and third parties– it shows your clients that you take cyber security seriously, and it builds trust and a good reputation, that you’re doing everything you can to mitigate the risks of a cyber breach.
Allows you to understand the environment–A penetration test allows you to understand what is going on in the environment around you, and it helps you to understand the types of cyber attacks that your organization may face.
Identifies weaknesses you didn’t know were there– Penetration testing looks for the potential backdoors into your network that exist without your knowledge.
There are both internal and external penetration tests, dependant on whether the tester is accessing the physical environment of the internet facing environment.
Penetration tests can traditionally be run internally within an organization or externally from the internet. The appropriate vantage point for the testing should be determined by an organization’s focus on risk. In addition, the two places for testing are not mutually exclusive. Organizations with a strong focus on risk management will most frequently conduct testing from both an internal and external perspective.
This type of testing assesses security through the eyes of an internal user, a temporary worker, or an individual that has physical access to the organization’s buildings.
Internal penetration tests are conducted from within an organisation, over its Local Area Network (LAN) or through WIFI networks. The tests will observe whether it is possible to gain access to privileged company information from systems that are inside the corporate firewalls.
Testers will assess the environment without credentials, and determine whether a user with physical access to the environment could extract credentials and then escalate privileges to that of an administrator or super user within the environment.
During an internal penetration test, the tester will attempt to gain access to sensitive data including PII, PCI card data, R&D material and financial information. They will also assess whether it is possible to extract data from the corporate environment and bypass any DLP or logging devices so as to assess any countermeasures or controls that have been put in place.
This type of testing assesses an organization’s infrastructure from outside of the perimeter firewall on the Internet. It assesses the environment from the vantage point of an internet hacker, a competitor or a supplier with limited information about the internet facing environment.
External pen testing will assess the security controls configured on the access routers, firewalls, Intrusion Detection Systems (IDS) and Web Application Firewalls (WAFS) that protect the perimeter.
External tests will also provide the ability to assess security controls for applications that are published through the internet. Tek Security recognizes that there is increasing logic being built into web services to deliver extranet, e-commerce and supply chain management functions to Internet users. As a consequence, Tek Security pays particular attention to these resources, and performs granular assessments on their build and configuration, as well as interaction with other data sources that sit in your protected network segments.
Let Tek Security guide you through the differences between black, white and grey box penetration testing services.
Tek Security has a robust testing methodology that extends across infrastructure and application testing engagements. Although every penetration test is tailored to our clients’ individual needs, we follow the same proven methodology so as to maintain a consistent and reproducible set of results.
From a high level perspective, Tek Security’s infrastructure testing methodology is based around seven core phases:
Testing Report & Documentation
To gain access to a sample management and technical report related to your industry vertical, please email us.
Tek Security ensures that all tests have a full debrief at the end of the engagement.
If required, Tek Security can deliver this debrief in a face to face manner. During this process we will provide a presentation of critical and high level vulnerabilities along with guidance on remediation and countermeasures.
When a face to face debrief is not required, Tek Security conducts debriefs through video conferenceand WebEX. Through this approach we are still able to share a comprehensive presentation of vulnerabilities and areas identified as being high risk. We are also able to give you live demonstrations of where exploitation was possible, together with guidance on how to secure the environment moving forward.