Vulnerability Assessment / Penetration Testing

Assessment Services

Vulnerability Assessments:
A vulnerability assessment is a broad span technical review of an environment designed to identify as many weaknesses as possible within the environment.  Each vulnerability identified and documented would include information describing the weakness, whether any exploits are known which can exploit the weakness, the severity/impact to security if the weakness is exploited, and the steps required to remediate the weakness.
 
A vulnerability assessment is best used when the target environment has not been previously assessed or prior assessments have indicated low to medium security maturity.  In these situations, the vulnerability assessment project is designed to create a prioritized roadmap of the security issues that need to be addressed within the environment.
 
Penetration Tests:
Penetration Tests are designed to determine whether an attacker can achieve specific goal(s) against a company’s current security posture.  A penetration test is a deeper, more invasive examination than a vulnerability assessment.  Additionally, during the penetration test the attacker will identify specific attack vectors which through their experience has the best chance of successfully achieving the agreed upon goal of the engagement.  The attack vectors will be different if the goal is denial of service as opposed to gaining administrator access or stealing data.
 
The output of a true penetration test is a report stating whether the goals identified at the commencement of the project were achieved or not, and any ancillary observations made along the way.   Penetration tests do not provide a complete list of vulnerabilities; additionally, the engagement does not provide any assurance on threats and risks not specifically included within the scope of the contract.
 
Web Application Security Tests:
Web application penetration testing is an assessment that uses manual and/or automated penetration tests to identify any vulnerability, security flaws or threats in an application which uses a web based user interface. The tests involve using/implementing any of the known malicious penetration attacks on the application. The penetration tester exhibits/fabricates attacks and environment from an attacker’s perspective, such as using SQL injection tests. The web application penetration testing key outcome is to identify security weakness across the entire web application and its components (source code, database, back-end network). It also helps in prioritizing the identified vulnerabilities and threats, and possible ways to mitigate them.
 
Social Engineering Tests:
Social engineering engagements are designed to evaluate the effectiveness of security awareness programs, incident response procedures, physical security of client facilities/data centers, and onsite technology controls to prevent malicious activities.