5
1 Penetration Testing Cyber Security Testing, Protection and Risk Mitigation
1
Penetration Testing
Cyber Security Testing, Protection and Risk Mitigation
32 32
Penetration testing aims to uncover security weaknesses in IT systems based on specific needs and targeted scope.
3
Security and privacyIn a world that is seemingly under attack from all angles, organisations should now take cyber security seriously.
There is real economic interest behind these attacks and the rewards are high. The theft of data has become one of the main targets for cyber-criminals, terrorist and nation state actors.
The past 2 years have seen increasing levels of attack affecting all industry and its customers, placing many businesses in the spotlight having suffered high profile breaches, which have resulted in loss of customer data and subsequent regulatory fines.
Bringing back control Organisations must be aware of what critical assets are at risk and to be able to Identify and mitigate complex security vulnerabilities before an attacker exploits them. By understanding how the most sophisticated attackers operate, based on intelligence gained, organisations can begin to attain realistic findings and recommendation for remediation and future protection.
Social Network
People
Process
Build Review
Mobile Application
Web Application
NetworkSocial
Engineering
Red Teaming
Penetration Testing
Penetration testing is a crucial activity for security and risk management leaders needing to assess their organisation’s exposure to threats and ability to meet regulatory requirements. 6point6’s penetration testing goes beyond vulnerability scanning to use multistep and multivector attack scenarios that first find vulnerabilities and then attempt to exploit them to move deeper into the enterprise infrastructure. Because this is how advanced targeted attacks work, penetration testing provides visibility into aggregations of misconfigurations or vulnerabilities that could lead to an attack.
2
5
Securing your environment
The number of cyber attacks is on the rise.
When comparing 2017 to 2018 figures there was a 350% increase in detected ransomware attacks and a 70% increase in detected spear-phishing attacks. Hacktivist, criminal and nation state hacking groups continue to learn techniques and methodologies from each other leading to more sophisticated attacks. As cyber-attacks become more and more common in the modern economy, there are now very few organisations that do not have to consider the risk of being hacked.
Companies that are concerned about the risk of being hacked need a way to evaluate how exposed their assets are to hacking and the type of attacks they are likely to face.
When to conduct penetration testingNew applicationApplication penetration testing attempts to exploit vulnerabilities and determine whether unauthorised access or other malicious activity is possible, benchmarked against the OWASP Top 10. Before the deployment and release of new applications, penetration testing is a critical component in any comprehensive release plan.
New infrastructure When new infrastructure is being deployed into your environment and is stable, a penetration test should be conducted before it is promoted into production. The test should consist of both manual and automated testing and should be conducted with the tester having both privileged and normal user access for the most benefit to your organisation.
Supply chainPenetration testing allows you to not only minimise the risk to your own business, but also to those suppliers who have a trust relationship with your technology. A company’s supply chain is now a key target for hackers in order to circumvent your security through a trusted partner.
Compliance The regulations, laws, and compliance your organisation is subject to define the frequency of a penetration test. Depending on the type of industry, one must comply with the rules that outline when and which system components, processes, and custom software should be tested. As a minimum, penetration testing should be carried out on an annual basis, however, a test should be carried out when major changes have taken place.
The first step in understanding how exposed you are to cyber-attacks is to look for security vulnerabilities and then exploit them in a controlled way to understand the potential impact. By investigating your security vulnerabilities in a secure environment, you can begin to understand how to mitigate those vulnerabilities. A by-product of this is that you will get the opportunity to evaluate how effective the security controls that you have in place are.
Our team of security testers provide you with the opportunity to make use of the full spectrum of security testing services. From elementary, quick and non-invasive vulnerability scans to long term and wide scope red team engagements. We make sure you find out what cyber-attacks you are vulnerable to and how you can mitigate those issues.
4
6
Security testing services
6point6 offers a wide range of security testing services. The most common types of engagements that we do are listed below. We have provided a short description to give you an understanding of what they are for and the benefits they offer. All of our testers specialise in particular services. We insist that our testers be trained in a specific service before they are allowed to deliver it. This means the customer can be sure that their tester is an expert in the field they are examining. If there is a security testing service you are interested in but cannot see it below, please enquire with us as we are more than likely to be able to deliver on your request.
The 6point6 approach to penetration testing is tailored to the requirements and risk profile of each client. However, we do have standard security testing methodologies which require testers to go through each of the test stages listed below:
Web applicationWe will perform a comprehensive assessment of a web application or API for vulnerabilities that can lead to unauthorised access or data exposure. All web focused testing covers the standard OWASP web testing practices. Our report will give you an understanding of the potential security risks of any systems that are exposed to the internet along with remediation advice for any risks that have been identified.
Mobile applicationThis test will fully explore all security issues that could be present in your mobile application. Our team is very familiar with both Android and iOS applications. Your application will be reverse engineered and security tested on both a jailbroken and non-jailbroken device. Clear and concise remediation advice will be given for each vulnerability.
InfrastructureWe will discover any security vulnerabilities on your locally hosted network infrastructure. Testing will utilise a mix of cutting-edge automated tools and manual testing expertise. We will help you understand the risks faced by your network from threats that are acting from both outside and inside your network.
Build review Evaluate how well locked down a device or system is. A build review can be performed on all types of assets from laptops and phones to firewall configurations and cloud hosted networks. Discover new security controls that can be applied to your company assets. These will reduce your security exposure in a cost effective and unrestrictive way.
Social engineering We emulate a phishing campaign that a hacker would perform. Our phishing campaigns are usually run in stages and cover several attack vectors, including fake login pages, malicious attachments and links. This exercise will test the cyber awareness within your organisation. You will get a break down of which users are vulnerable to these types of attacks.
Red teaming Pulling all the other testing services together, a Red Team will target all systems in your organisation using any type of attack possible. These are typically much longer and larger in scope than other test types. This engagement will exercise your security team against a real attacker in a controlled way, helping you understand the likely exploitation paths an attacker would use on you.
Penetration testing methodology and deliverables
Target reconnaissance Passive scanning and manual exploration are used to obtain information that will be useful for further attacks. This stage will give the testers a good understanding of the system or application being assessed and its environment.
Vulnerability enumeration Active and passive scanning is performed using tools that automate the search for publicly disclosed vulnerabilities. These scans are run against all known hosts within the test scope using the permission and access credentials provided.
Vulnerability exploitation Relevant identified vulnerabilities are used to obtain access to new resources or information that help build further complex attacks. This stage is executed recursively until the target is obtained or no additional vulnerabilities are found.
Post exploitation This stage is used for evidence collection during the penetration test. Additional activities include reversing changes on systems made as part of the vulnerability exploitation stage that could otherwise compromise security after the test is completed.
Reporting A risk analysis based on the technical findings and their recommended remediation steps is consolidated into a report.
Risks are scored using 6point6’s scoring scheme which is based on CVSSv3 and our wealth of experience working in both the private and public sectors. This provides a uniform way to rank risks across diverse platforms and facilitates remediation planning.
The report will provide you with a detailed analysis of all findings for technical readers as well as a high-level executive summary, along with steps required to remediate any vulnerabilities and findings both now and for the future. If required, a presentation to key stakeholders will be performed.
7
8
About 6point6
Integrating digital technology into your business can result in fundamental changes to how you operate and deliver value to your customers. To go digital is to reinvent yourself to the core, opening yourself and your clients to a world of possibilities.
6point6 is a technology consultancy. We bring a wealth of hands-on experience to help businesses achieve more with digital.
Using cutting edge technology and agile delivery methods, we help you reinvent, transform and secure a brighter digital future.
Visit us at 6point6.co.uk Twitter: @6point6ltd LinkedIn: linkedin.com/company/6point6
Get in touch
MISHA NEWMAN
Managing ConsultantCyber [email protected]
LAURIE GRAHAM
Intelligence DirectorCyber [email protected]
SIX.SIX.136
