Penetration Testing
Think Like A Crook To Secure Like A Pro.
Penetration testing is exactly what it sounds like – testing how far a threat actor can penetrate into your business.
If you’ve seen a spy movie, you can fully understand the damage a jump drive can do in the wrong hands.
Reveal, Re-Assess, Resecure
Security Starts Before Your Doors
Physical: Identify what is in the area that can be utilized by a threat actor, like lack of lighting or power to the building.
Cyber: Many businesses have guest WiFi extending to the parking lot. What outside access can someone have into your network?
Evaluate The Assets
Physical: Identify and catalog physical assets like your servers, networking equipment, and endpoints within the facility.
Cyber: Identify and document virtual assets, networks, and systems accessible remotely
Protect The Data
Physical: Evaluate physical security measures for data protection, like secure storage and access controls.
Cyber: Assess data protection measures for virtual assets, emphasizing encryption and access controls.
Secure Configurations
Physical: Verify all physical devices have secure configurations to minimize potential vulnerabilities.
Cyber: Examine secure configurations of remote assets, focusing on servers, routers, and firewalls.
Account Management
Physical: Assess physical access controls, like employee and guest badging, and account management processes.
Cyber: Evaluate remote access controls, multi-factor authentication, and account management practices.
Incident Response
Physical: Simulate physical security incidents to evaluate the organization’s incident response capabilities.
Cyber: Simulate cyber incidents, assessing the organization’s ability to detect and respond remotely.
Continuous Monitoring
Physical: Test the effectiveness of physical security monitoring, including surveillance systems.
Cyber: Evaluate the organization’s ability to monitor and respond to security events remotely
Network Security
Physical: Assess the physical network architecture and controls.
Cyber: Evaluate remote network security measures, including firewalls, intrusion detection/prevention systems, and VPNs.
Vulnerability Management
Physical: Identify and exploit physical vulnerabilities to test the organization’s vulnerability management processes.
Cyber: Conduct vulnerability assessments and exploit remote vulnerabilities to assess the organization’s response.
