Penetration testing

Penetration Test

The best way to study the systems security against an attack is to experience one, but in a controlled and ethical way. In this type of analysis, apart from discovering the vulnerabilities in the computers, such vulnerabilities are exploited in order to assess the real impact of each of them and their specific danger in their environment.

A2SECURE provides Pentesting services, working accordingly to standards such as OSSTM, OWASP, PCI-DSS, NIST, and other regulatory frameworks.

Why?

Whether it is because of the company policy, to comply with existing standards such as PCI-DSS or simply to know the exact security status of our infrastructure, the implementation of Pentesting allows us to know our security status and to establish an improvement plan to mitigate risks which already exist as they have been exploited.

How?

A Pentesting is a means to discover vulnerability and its exploitation in order to accurately assess the extent of the problem. That is, finding ways of information leakage, unauthorized access to restricted areas, and so on.

This activity can be addressed through different perspectives, which give more or less ease to the pentester team in terms of access to the initial information which the client may provide. The different types of pentesting are “black box”, “grey box” and “white box”.

Validations to be performed in such projects depend on their scope, which may include among others:

• FW rules checks
• Analysis of segmentation
• Discovery and exploitation of system vulnerabilities
• Discovery and exploitation of application vulnerabilities
• Code review
• Password cracking
• Discovery of users and impersonation
• Etc.

We always work closely with our clients providing information at all times about our actions and discoveries. For us, working closely with our clients is the best way to understand and help them.

Results and Benefits

The penetration test services are tailor-made projects for our clients. Thus, our work begins and ends where the client requires, either with:

• Technical outcomes report
• Executive reporting
• Presentation of results meetings and workshops
• Training sessions aimed at understanding the deficiencies found
• Remediation period support
• Validation of remediation

The benefit of this type of service is to know what are the real possibilities for our systems in the event of an attack before it actually occurs. This knowledge allows us to anticipate and remedy the breaches found by correcting their causes.