ASSESSMENTS & TESTING
PENETRATION TESTING SERVICES
XORISK’S EXPERT PENETRATION TESTERS CONDUCT COMPREHENSIVE IN-DEPTH ASSESSMENTS OF IT SYSTEMS, WITH THE OWNER’S PERMISSION, REVEALING HIDDEN SECRETS IN THE SAME WAY AS REAL ATTACKERS DO. WE HELP TO TRANSFORM THE TECHNICAL FINDINGS INTO IMMEDIATELY ACTIONABLE REMEDIATION STEPS – AIMING TO PROTECT YOUR NEEDS AND HARD-WON REPUTATION.
OUR PENETRATION TESTING SERVICE INVOLVES AN ACTIVE ANALYSIS OF THE ASSET FOR ANY POTENTIAL SECURITY VULNERABILITY. THIS COULD RESULT FROM POOR OR IMPROPER CONFIGURATION, BOTH KNOWN AND UNKNOWN HARDWARE OR SOFTWARE FLAWS, AND OPERATIONAL WEAKNESSES IN PROCESS OR TECHNICAL COUNTERMEASURES. THE ANALYSIS IS CARRIED OUT TO SIMULATE REAL-LIFE CYBER-ATTACKS FROM THE POSITION OF A POTENTIAL ATTACKER AND CAN INVOLVE ACTIVE EXPLOITATION OF SECURITY VULNERABILITIES. WE WILL WORK CLOSELY WITH YOU TO HELP IDENTIFY AND ELIMINATE AREAS OF POTENTIAL RISK. ANY SECURITY ISSUES THAT ARE FOUND WILL BE PRESENTED TO YOUR ORGANISATION, TOGETHER WITH AN ASSESSMENT OF THEIR IMPACT, AND OFTEN WITH A PROPOSAL FOR MITIGATION OR A TECHNICAL SOLUTION
OUR RANGE OF PEN TESTING SERVICES ARE:
NETWORK PENETRATION TESTING (INTERNAL/EXTERNAL)
WE SIMULATE REAL-WORLD ATTACKS TO PROVIDE A POINT-IN-TIME ASSESSMENT OF VULNERABILITIES AND THREATS TO YOUR NETWORK INFRASTRUCTURE.
WEB APPLICATION PENETRATION TESTING
IN ADDITION TO THE OPEN SOURCE SECURITY TESTING METHODOLOGY MANUAL (OSSTMM) AND THE PENETRATION TESTING EXECUTION STANDARD (PTES) RAPID7’S APPLICATION PENETRATION TESTING SERVICE LEVERAGES THE OPEN WEB APPLICATION SECURITY PROJECT (OWASP), A COMPREHENSIVE FRAMEWORK FOR ASSESSING THE SECURITY OF WEB-BASED APPLICATIONS, AS A FOUNDATION FOR OUR WEB APPLICATION ASSESSMENT METHODOLOGY.
RED TEAM ASSESSMENTS
WANT TO FOCUS ON YOUR ORGANIZATION’S DEFENSE, DETECTION, AND RESPONSE CAPABILITIES? XORISK WORKS WITH YOU TO DEVELOP A CUSTOMIZED ATTACK EXECUTION MODEL TO PROPERLY EMULATE THE THREATS YOUR ORGANIZATION FACES. THE SIMULATION INCLUDES REAL-WORLD ADVERSARIAL BEHAVIORS AND TACTICS, TECHNIQUES, AND PROCEDURES (TTPS), ALLOWING YOU TO MEASURE YOUR SECURITY PROGRAM’S TRUE EFFECTIVENESS WHEN FACED WITH PERSISTENT AND DETERMINED ATTACKERS.
WIRELESS NETWORK PENETRATION TESTING
WE LEVERAGE THE OPEN SOURCE SECURITY TESTING METHODOLOGY MANUAL (OSSTMM) AND THE PENETRATION TESTING EXECUTION STANDARD (PTES) AS A FOUNDATION FOR OUR WIRELESS ASSESSMENT METHODOLOGY, WHICH SIMULATES REAL-WORLD ATTACKS TO PROVIDE A POINT-IN-TIME ASSESSMENT OF VULNERABILITIES AND THREATS TO YOUR WIRELESS NETWORK INFRASTRUCTURE.
MOBILE APPLICATION PENETRATION TESTING
AS THE WIDESPREAD USE OF MOBILE APPLICATIONS CONTINUES TO GROW, CONSUMERS AND CORPORATIONS FIND THEMSELVES FACING NEW THREATS AROUND PRIVACY, INSECURE APPLICATION INTEGRATION, AND DEVICE THEFT. WE GO BEYOND LOOKING AT API AND WEB VULNERABILITIES TO EXAMINE THE RISK OF THE APPLICATION ON A MOBILE PLATFORM. WE LEVERAGE THE OPEN WEB APPLICATION SECURITY PROJECT (OWASP), OPEN SOURCE SECURITY TESTING METHODOLOGY MANUAL (OSSTMM), AND PENETRATION TESTING EXECUTION STANDARD (PTES) METHODOLOGIES TO THOROUGHLY ASSESS THE SECURITY OF MOBILE APPLICATIONS.
IOT AND INTERNET-AWARE DEVICE TESTING
INTERNET-AWARE DEVICES SPAN FROM UBIQUITOUS, COMMERCIAL INTERNET OF THINGS (IOT) DEVICES AND SYSTEMS TO AUTOMOTIVE, HEALTHCARE AND MISSION CRITICAL INDUSTRIAL CONTROL SYSTEMS (ICS). OUR TESTING GOES BEYOND BASIC DEVICE TESTING TO CONSIDER THE ENTIRE ECOSYSTEM OF THE TARGET, COVERING AREAS SUCH AS COMMUNICATIONS CHANNELS AND PROTOCOLS, ENCRYPTION AND CRYPTOGRAPHY USE, INTERFACES AND APIS, FIRMWARE, HARDWARE, AND OTHER CRITICAL AREAS. OUR DEEP DIVE MANUAL TESTING AND ANALYSIS LOOKS FOR BOTH KNOWN AND PREVIOUSLY UNDISCOVERED VULNERABILITIES.
SOCIAL ENGINEERING PENETRATION TESTING
MALICIOUS USERS ARE OFTEN MORE SUCCESSFUL AT BREACHING A NETWORK INFRASTRUCTURE THROUGH SOCIAL ENGINEERING THAN THROUGH TRADITIONAL NETWORK/APPLICATION EXPLOITATION. TO HELP YOU PREPARE FOR THIS TYPE OF STRIKE, WE USE A COMBINATION OF HUMAN AND ELECTRONIC METHODOLOGIES TO SIMULATE ATTACKS. HUMAN-BASED ATTACKS CONSIST OF IMPERSONATING A TRUSTED INDIVIDUAL IN AN ATTEMPT TO GAIN INFORMATION AND/OR ACCESS TO INFORMATION OR THE CLIENT INFRASTRUCTURE. ELECTRONIC-BASED ATTACKS CONSIST OF USING COMPLEX PHISHING ATTACKS CRAFTED WITH SPECIFIC ORGANIZATIONAL GOALS AND RIGOR IN MIND. RAPID7 WILL CUSTOMIZE A METHODOLOGY AND ATTACK PLAN FOR YOUR ORGANIZATION.
A PENETRATION TEST WILL HELP YOU:
VULNERABILITY SCANNING SERVICES
REGULAR PENETRATION TESTING REPORTS SHOWING EITHER COMPLETE SYSTEM STATUS OR CHANGES SINCE YOUR LAST VULNERABILITY SCAN, ARE PROVIDED BY OUR DEDICATED SECURITY EXPERTS. WE REDUCE YOUR ADMINISTRATIVE AND MAINTENANCE BURDENS SO YOU CAN BETTER FOCUS ON PROTECTING YOUR ASSETS AND, MOST IMPORTANTLY, REDUCING BUSINESS RISK. MANAGED VULNERABILITY SCANNING IS VITAL TO IDENTIFY AND REMEDIATE VULNERABILITIES WITHIN YOUR IT ENVIRONMENT, BEFORE HACKERS CAN GAIN EXPLOIT THEM. AND OVERALL CAN REDUCE AND MANAGE RISK ON AN ON-GOING BASIS TO PREVENT CYBER-ATTACKS ON EXTERNAL-FACING NETWORKS. HOWEVER IT IS RECOMMENDED TO CARRY OUT VULNERABILITY SCANNING ALONGSIDE REGULAR PENETRATION TESTING, TO ENSURE ALL BASES ARE COVERED.
FIREWALL REVIEW SERVICES
OUR FIREWALL BASELINE REVIEW SERVICE OFFERS YOU A DETAILED ANALYSIS AND TEST OF A FIREWALL CONFIGURATION THAT HAS BEEN IN PLACE TO PROTECT YOUR INFORMATION, APPLICATIONS, SYSTEMS AND OVERALL BUSINESS OPERATIONS. DURING A FIREWALL RULESET REVIEW, A CONSULTANT PERFORMS A LINE-BY-LINE ANALYSIS OF THE EXISTING CONFIGURATION, AND EXAMINES VULNERABILITIES ASSOCIATED WITH A SPECIFIC VENDOR’S SOLUTION.
To receive Newsletter
Licensing Expertise
© 2018 Copyright Xorisk Consulting LLP. All Rights Reserved.
Powered by Pebble Softwares