|Skorpion Security Inc|
Computer Penetration Testing
Skorpion Security Inc. specializes in remote and on site computer penetration testing. Computers are an integral part of today's business environment. Any security consulting firm not addressing your computer security is not providing your company with adequate security. Testing of residential, small business and large corporate infrastructures can be conducted remotely. After penetrating the system, comprehensive reports are created describing in detail the method of exploitation. The report also details counter-measures steps that need to be taken to prevent future hostile penetrations.
Penetration testing is an often confused term. This guide provides a broad overview of what it means, why you would want it, and how to get the most out of the process.
What is a penetration test?
Much of the confusion surrounding penetration testing stems from the fact it is a relatively recent and rapidly evolving field. Additionally, many organizations will have their own internal terminology (one man’s penetration test is another’s vulnerability audit or technical risk assessment).
At its simplest, a penetration-test (actually, we prefer the term security assessment) is the process of actively evaluating your information security measures. Note the emphasis on ‘active’ assessment; the information systems will be tested to find any security issues, as opposed to a solely theoretical or paper-based audit.
The results of the assessment will then be documented in a report, which should be presented at a debriefing session, where questions can be answered and corrective strategies can be freely discussed.
Why conduct a penetration test?
From a business perspective, penetration testing helps safeguard your organization against failure, through:
From an operational perspective, penetration testing helps shape information security strategy through:
What can be tested?
All parts of the way that your organization captures, stores and processes information can be assessed; the systems that the information is stored in, the transmission channels that transport it, and the processes and personnel that manage it. Examples of areas that are commonly tested are:
What should be tested?
Ideally, your organization should have already conducted a risk assessment, so will be aware of the main threats (such as communications failure, e-commerce failure, loss of confidential information etc.), and can now use a security assessment to identify any vulnerabilities that are related to these threats. If you haven’t conducted a risk assessment, then it is common to start with the areas of greatest exposure, such as the public facing systems; web sites, email gateways, remote access platforms etc.
Sometimes the ‘what’ of the process may be dictated by the standards that your organization is required to comply with. For example, a credit-card handling standard may require that all the components that store or process card-holder data are assessed.
What do you get for the money?
While a great deal of technical effort is applied during the testing and analysis, the real value of a penetration test is in the report and debriefing that you receive at the end. If they are not clear and easy to understand, then the whole exercise is of little worth.
Ideally the report and debriefing should be broken into sections that are specifically targeted at their intended audience. Executives need the business risks and possible solutions clearly described in layman's terms, managers need a broad overview of the situation without getting lost in detail, and technical personnel need a list of vulnerabilities to address, with recommended solutions.
What to do to ensure the project is a success
Defining the scope
The scope should be clearly defined, not only in the context of the components to be (or not to be) assessed and the constraints under which testing should be conducted, but also the business and technical objectives. For example penetration testing may be focused purely on a single application on a single server, or may be more far reaching; including all hosts attached to a particular network.
Choosing a security partner
Another critical step to ensure that your project is a success is in choosing which supplier to use.
As an absolute fundamental when choosing a security partner, first eliminate the supplier who provided the systems that will be tested. To use them will create a conflict of interest (will they really tell you that they deployed the systems insecurely, or quietly ignore some issues).
Detailed below are some questions that you might want to ask your potential security partner:
For more information on Computer Penetration Test contact sales at: firstname.lastname@example.org