Search for:

IT Security & Testing

Organizations are building, maintaining, and improving their network defenses against internal and external malicious users and attackers every day. While understanding how well these defenses withstand adversaries, is imperative to keep your fortress secure.

We take the time to understand our client’s business and think as an attacker would. This allows us to gain a holistic overview, as well as a technical point of view. Using set objectives, we will identify the weakest link first, and then escalate until one or several bastions fall, and we gain privileged access to information or systems.

Our penetration testing services leverage a hybrid approach composed of automated and manual testing methods. Attempts to gain privileged access to firewalls, networks and respective devices, servers, IoT, web applications, and other points of exposure will be conducted in a safe and controlled manner while exploiting identified vulnerabilities. Once a vulnerability has been successfully exploited, our security analysts will attempt to increase their foothold by launching succeeding exploits to gain higher levels of privileges and deeper access to electronic assets and information.

Supporting IT functions With

Web App Penetration Testing

Comprehensive penetration test of your web applications, web services, and APIs that may be used to store and access critical business information, with the goal to identify and exploit web-borne vulnerabilities. Our pen-testers will use advanced skills and techniques required to test modern web applications and next-generation technologies.

App Security Assessment

Access to your mobile applications to identify vulnerabilities specific to mobile computing environments, such as those defined by the Open Web Application Security Project (OWASP) and other emerging industry standards.

Network Penetration Testing

Evaluation of your internal or external information assets’ ability to withstand attacks. Our world-class penetration testers, armed with the same techniques as cybercriminals, will attempt to break into your network, IT infrastructure, and servers to raise awareness about vulnerabilities and the effects of exploitation, as well as end-user adherence to security policies.

Worldwide Penetration Testing

Our Blackbox Web Application Penetration Test services typically assess the unauthenticated and public section of the web application for weaknesses and vulnerabilities. In addition to testing the unauthenticated section, our Greybox Web Application Penetration tests will also have for objective to test the authenticated section of the applications as well as its internal features to ensure a standard user cannot gain access to information he or she should not have access to.

Our cyber security analysts and penetration testers use a hybrid approach when testing web applications, which combines the advantages of both automated tools and manual testing for a more controlled and thorough penetration test.

Our penetration testing methodology builds on the approach outlined in the OWASP Testing Guide, Open Source Security Testing Methodology Manual (OSSTMM), and Penetration Testing Execution Standard (PTES).

Detailed Preparation

Reconciling Information

Mapping Process

Vulnerability Discovery

Vulnerability Exploitation

Analysis & Reporting

What are we testing?

Our penetration tests evaluate web applications, including but not limited to CWE/SANS TOP 25 Most Dangerous Software Errors and OWASP Top Ten Vulnerabilities…The following is a non-inclusive list of items that will be checked:

  • Injection flaws (e.g. SQL, LDAP, OS command, XPath, XQuery, XSLT, XML)
  • Business logic vulnerability
  • Cross Site Scripting (XSS) and Cross Site Request Forgery (CSRF)
  • Improper authentication or session management
  • XML External Entities (XXE)
  • Improper access control
  • Missing encryption or improper use of cryptographic algorithms
  • Usage of components with known vulnerabilities
  • Security misconfiguration
  • Insecure direct object references or path traversal

Our Cyber Security Partner Credentials