ThreatPerspectivePenetration Testing
Engage us to prove that vulnerabilities in your IT infrastructure and applications can lead to compromise.
What is a Penetration Test?
ThreatPerspective's penetration test service provides our clients with the ability to prove weaknesses that exist in their network infrastructure or applications can be leveraged to obtain sensitive data or priveleged access.
A penetration test differs from a network vulnerability, or application assessment in that the other types of assessments are typically more thorough in regards to finding vulnerailbities. A penetration test is typically more targeted and usually ends when a pre-determined goal is achieved. Typical zero knowledge network vulnerability assessments only provide details of issues that were discovered based on results of conditions observed from analyzing services that are listening on target hosts. During a penetration test, assessors will attempt to exploit vulnerabilities to gain access to specifc hosts and then attempt to see what conditions exist on that host that may lead to further compromise of a system, obtaining sensitive data, or lead to the compromise of other hosts in the infrastructure. These issues may not be readily identified during a typical vulnerability assessment. It is possible to conduct penetration tests on weaknesses discovered during a vulnerabiltiy assessment if a customer wishes. Penetration tests provide indisputable proof that a compromise is possible.
Penetration Tests can help assess the effectiveness of your IT Security Training regime and compensating controls by testing your employees and host based Anti Virus resiliance to Phishing and other Social Engineering attacks. We have a very high success rate with regards to Phishing and Social Engineering - often times, all it takes is one hit that creates a direct path to achieve the goal of the Penetration Test.
Penetration Tests can also test the effectiveness of your Managed Services Security Provider (MSSP) in identifying and blocking attacks that may be in progress during unannouced (to the MSSP) testing.
Find out if your firewall is just a speed bump by hiring us to perform a Penetration Test!
How we perform a Penetration Test
The first step we perform in a Penetration Test is negotiating the goal with the customer. Consider the "goal" to be the tester's objective. Typically the goal of most penetration tests is to find PII/PHI, obtain access or elevated privileges on a server, or prove in some way that users are at risk when they access your resources. But, the goal can be anything, for example, retrieving a specific file off of a server where the file is the "flag".
The next step is negotiating the rules of engagement. Here we would decide if this is going to be a zero knowledge engagement where we perform open source intelligence gathering, provide the target lists to the you to approve, modify, etc, or is this a cooperative engagment where all necessary information is provided by the customer to save time and money? Is the engagement overt or unannounced. Are there any systems or users (typically executives) that are out of scope? What techniques are ok to be employed (Phishing/Social Engineering)? If we identify a vulnerability should we contact the customer prior to exploiting it, or see how far we can get? How often will there be status updates? If we encounter issues who do we call? How much time will be spent? Are there any time constraints (nights and weekends only, or conversly, only during working hours)? If no access from the Internet is obtained, will there be a malicious insider simulation? Etc.
Once both parties have mutually agreed to commence, the Penetration Test begins and is conducted according to the rules of engagement.