Penetration Testing and IS Audit Services
About Penetration Testing
It’s the process to identify security vulnerabilities in an application by evaluating the system or network with various malicious techniques. Purpose of this test is to secure important data from outsiders like hackers who can have unauthorized access to system. Once vulnerability is identified it is used to exploit system in order to gain access to sensitive information.
Causes of vulnerabilities
- Design and development errors
- Poor system configuration
- Human errors
Vulnerability Assessment Vs Penetration Test
Vulnerability assessment is a process for assessing the infrastructure security controls by identifying the threats that pose serious exposure to the organizations assets. This technical infrastructure evaluation not only points at the risks in the existing defenses, but also recommends and prioritizes the remediation strategies. Each asset on the network is rigorously tested against multiple attack vectors to identify unattended threats and quantify the reactive measures. Depending on the type of assessment being carried out, a unique set of testing processes, tools, and techniques are followed to detect and identify vulnerabilities in the information assets in an automated fashion.
On the other hand, penetration testing goes beyond the level of identifying vulnerabilities and step into the process of exploitation, privilege escalation, and maintaining access to the target system (measuring the impact of these flaws on the given system). Another major difference between these two terms is that the penetration testing is considerably more intrusive and aggressively applies all the technical methods to exploit the live production environment.
The penetration testing methodology we use is based on industry best practices such as ISSAF and OSSTMM and Backtrack testing methodology:
- Target Scoping: What has to be tested, how it should be tested, what conditions should be applied during the test process, what will limit the execution of test process, how long will it take to complete the test, and what business objectives will be achieved
- Information Gathering: Use a number of publicly available resources (Google Hacking) and tools to extract information about the target.
- Target Discovery and enumeration: Mainly deals with identifying the target’s network status, operating system, and its relative network architecture along with open ports. Once the open ports are identified, they can be enumerated for the running services.
- Vulnerability Mapping: After gathering sufficient information about the target network. It is now time to identify and analyze the vulnerabilities based on the disclosed ports and services. This process can achieved via a number of automated network and application vulnerability assessment tools.
- Social Engineering (optional): when there is no open gate available to enter the target network, it is still possible to penetrate the target system by tricking a user into executing malicious code that should give backdoor access.
- Target Exploitation: This phase mainly focuses on target acquisition process and to penetrate into the target system based on the types of exploits discovered.
- Privilege Escalation: The purpose of privilege escalation is to gain the highest level access to the system, once the target is acquired local exploits is used to obtain system-level privileges or super-user access.
- Maintaining Access: This phase can be used to demonstrate illegitimate access to the system without going through the pen testing process again. The Pen Tester will maintain his footsteps into the target system as long as required by the target scope.
- Documentation and Reporting: Documenting, reporting, and presenting the vulnerabilities found, verified, and exploited
Why Penetration testing?
- Financial data must be secured while transferring between different systems
- Many clients are asking for pen testing as part of the software release cycle
- To secure user data
- To find security vulnerabilities in an application
It’s very important for any organization to identify security issues present in internal network and computers. Using this information organization can plan defense against any hacking attempt. User privacy and data security are the biggest concerns nowadays. Imagine if any hacker manage to get user details of social networking site like Facebook. Organization can face legal issues due to a small loophole left in a software system. Hence big organizations are looking for PCI compliance certifications before doing any business with third party clients.
What should be tested?
Our extensive experience, our well documented processes and checklists and our vulnerability databases ensures that we will provide your organization with a methodical, meticulous, comprehensive evaluation of your technical environment. Our Ethical Hacking consultants have partnered with many of the world’s largest financial institutions to secure their electronic commerce solutions and web based services. These services include, but are not limited to:
IT Security audit/Pen Test