What Is Penetration Testing?

Penetration testing (or pen testing) is a type of cybersecurity test that identifies vulnerabilities, threats, and risks in networks, systems, and applications. While vulnerability scanning attempts to identify known vulnerabilities, a penetration test (or pen test) is intended to exploit the weaknesses to gain full situational awareness when it comes to cybersecurity including organizational risk, threats, vulnerabilities, and potential business impact.

Why Do I Need A Penetration Test?

Penetration testing is one of the best security practices that you can take.

Penetration testing can evaluate your security controls and provide you with recommendations to enhance your overall security posture. Penetration testing can include real-world security tests using advanced hacking methods to help you identify your weaknesses and improve your security posture. Advanced penetration tests can also simulate attacks on your network using similar techniques as malicious attackers to see if you can identify active attacks!

Penetration Testing Compliance Requirements

Penetration testing is required for regulatory and compliance standards including:

• Payment Card Industry Data Security Standard (PCI DSS)
• Health Insurance Portability and Accountability Act (HIPAA)
• Sarbanes-Oxley (SOX)
• General Data Protection Regulation (GDPR)
• Gramm-Leach-Bliley Act (GLBA)
• Federal Risk and Authorization Management Program (FedRAMP)
• Federal Financial Institutions Examination Council (FFIEC)
• International Organization for Standardization (ISO)
• Federal Information Security Management Act (FISMA)
• National Institute of Standards and Technology (NIST)
• HITRUST

PCI DSS Annual Penetration Testing

PCI DSS requires that you perform external penetration testing and internal penetration testing annually.

PCI DSS Significant Change Penetration Testing

PCI DSS requires that you perform penetration testing after significant changes. PCI DSS 4.0 defines a significant change as:

• New hardware, software, or networking equipment added to the CDE
• Any replacement or major upgrades of hardware and software in the CDE
• Any changes in the flow or storage of account data
• Any changes to the boundary of the CDE and/or to the scope of the PCI DSS assessment
• Any changes to the underlying supporting infrastructure of the CDE (including, but not limited to, changes to directory services, time servers, logging, and monitoring)
• Any changes to third party vendors/service providers (or services provided) that support the CDE or meet PCI DSS requirements on behalf of the entity

Security Frameworks

Penetration testers should be familiar with a variety of security frameworks including:

• PTES
• Open Web Application Security Project (OWASP)
• Information Systems Security Assessment Framework (ISSAF)
• Open Source Security Testing Methodology Manual (OSSTMM)

Penetration Testing Authentication

Will the penetration tester have credentialed access to the network, systems, and web applications?

• Unathenticated
• Authenticated

Penetration Testing Approach

There are different approaches to a penetration test including:

• Black-box
• Grey-box
• White-box

Penetration Testing Focus

What will the focus of the penetration test be?

• External
• Internal

Areas That Should Receive Penetration Testing

The following areas at a minimum should receive routine penetration testing:

• External Network Penetration Testing
• Internal Network Penetration Testing
• Web Application Penetration Testing
• Mobile Application Penetration Testing
• Physical Penetration Testing
• Wireless Penetration Testing
• Social Engineering Penetration Testing
• Cloud Penetration Testing

Should I Just Focus On A Good Defense Strategy?

Have you ever heard of the saying “The best defense is a good offense”? Looking at your organization’s security though an offensive perspective can improve its defenses and its overall secure posture. Running antivirus software, having firewalls, and hoping that your business is secure is not enough. You need to uncover and fix vulnerabilities before the cybercriminals exploit them.

Why You Need Independent Security Testing

Organizations benefit from independent security testing. Not every business has their own internal team of security professionals, and even those that do, could benefit from a fresh set of eyes.

Routine penetration tests can:

• Identify your vulnerabilities
• Determine the exploitability of vulnerabilities
• Measure the potential impact of vulnerabilities
• Assess organization risk
• Prioritize your remediation efforts
• Meet regulatory and compliance standards
• Explain security concerns to technical engineers and application developers
• Justify security-related initiatives to executive leadership

How Often Do I Need Security Testing?

There is no magic number that fits every organization. Routine penetration testing should be performed to identify potential security vulnerabilities. Annual penetration tests are not enough. Monthly or quarterly penetration tests, along with weekly or monthly vulnerability scanning are much more effective at improving your overall security posture. Penetration testing should also be performed after network changes, application updates, and when new systems are brought onto the network.

Best Pen Test Companies

Central InfoSec was rated the "best boutique penetration testing company" and the "best penetration testing firm" by two independent third-party organizations that review many contributing factors.

Automated Vulnerability Scanning vs Manual Penetration Testing

While vulnerability scanning may be included in the initial phase of vulnerability identification, manual analysis and manual testing is a must. Vulnerability scanners alone can often miss vulnerabilities, report false positives, or not give accurate risk ratings. Manual penetration testing includes additional techniques to identify vulnerabilities along with human analysis to gauge the true severity, potential impact, and organizational risk.

Running a vulnerability scan and saying you may be vulnerable is completely different than actually exploiting vulnerabilities. If you hire a firm that relies on automatic vulnerabilities scanners, critical vulnerabilities could be missed. Central InfoSec team members have published custom tools to track manually found findings that scanners miss.

Should You Completely Avoid Automated Vulnerability Scanning?

Absolutely not! While automated security testing cannot replace manual penetration testing, there are some benefits to automated scanning. Automated scanning offers advantages such as speed and wider coverage. However, penetration testing cannot be completed with automated vulnerability scanning alone. Vulnerably scans often include a high rate of false positive findings which need manual validation. Automated scanning tools will not identify all vulnerabilities and cannot chain multiple vulnerabilities together to form complex attacks.

What Happens After the Pen Test?

After completing a penetration test, the penetration testing team will share their findings with the company's security team.

Penetration Testing Reporting

Every penetration tester should be able to provide detailed documentation of their findings. Reports should include an attack narrative, detailed findings, risk ratings, and remediation details to prevent future attacks against the organization. Organizations should be able to leverage the penetration testing report to make decisions, implement security controls, and remediate vulnerabilities.

Who Is Actually Performing Your Testing?

Ask questions about who is actually performing the testing. Stay clear of companies that can’t answer simple questions. Some questions you can ask include:

• Who will be performing the testing?
• How many years of experience does the tester have performing web application penetration testing?
• Does the tester have relevant professional security certifications and credentials?
• Has the tester created professional web application testing tools and plugins?
• Is the tester a fulltime employee or a contractor?
• Is this the first security role or first penetration testing role that the tester has ever been in?

Ensure the Security Professionals Have Relevant Certifications

Depending on the type of work being performed, security professionals should have relevant certifications. Central InfoSec team members have achieved professional certifications including:

• Certified Red Team Operator (CRTO)
• Offensive Security Certified Professional (OSCP)
• Offensive Security Wireless Professional (OSWP)
• GIAC Certified Penetration Tester (GPEN)
• GIAC Cloud Penetration Tester (GCPN)
• GIAC Mobile Device Security Analyst (GMOB)
• Amazon Web Services Security Specialty (AWS CSS)
• Amazon Web Services Cloud Practitioner (AWS CCP)
• EC-Council Certified Ethical Hacker (C|EH)
• CompTIA Network Vulnerability Assessment Professional (CNVP)
• CompTIA PenTest+

Professional Security Services Offered by Central InfoSec

Central InfoSec offers a variety of professional security services including:

• Red Teaming
• Attack simulation to test, measure, and improve your detection and response
• Penetration Testing
• Real-world security tests using advanced hacking methods to identify your weaknesses
• Vulnerability Assessments
• Identification of potential vulnerabilities in your network and applications
• Application & API Testing
• Testing of security controls and products to identify your gaps and weaknesses
• vCISO Services
• Virtual CISO (vCISO) services allowing immediate access to strategic security guidance
• Cyber Risk Management
• Cyber solutions to help address security threats and to help you reach your security initiatives
• Phishing Assessment
• Effective security awareness training through social engineering and phishing emails
• Managed Phishing
• Routine phishing campaigns to track and measure the security awareness of your employees
• Password Audit
• Detection of weak passwords to help you improve your password policies
• C2 & Pivot Testing
• Command and control (C2) communications, pivoting, and data exfiltration testing
• Purple Team Tabletop
• Targeted training exercises to measure people, processes, and technologies
• Security Training
• Fully customizable cyber security training and employee awareness support

Best Boutique Penetration Testing Company

Central InfoSec named Best Boutique Penetration Testing Company by the Global 100 Awards.

Best Penetration Testing Firm

Central InfoSec named Best Penetration Testing Firm by Corporate Vision's Corporate Excellence Awards.

“Central InfoSec helps organizations by discovering network and web application vulnerabilities before the hackers do!”

Central InfoSec is an award-winning cyber security company that offers professional security services including Red Teaming, Penetration Testing, and Security Training.

The Central InfoSec team consists of skilled security professionals bringing a total of 20+ years of red teaming, penetration testing, web application, and exploitation experience. Central InfoSec team members have achieved industry leading professional certifications including CRTO, OSCP, OSWP, GXPN, GPEN, GCPN, GWAPT, GMOB, AWS-CSS, AWS-CCP, PenTest+, CEH, CISSP, and more.

The Central InfoSec team goes one step further and develops open-source tools including Burp Suite extensions, Cobalt Strike aggressor scripts, scripts tying into tools (including GoPhish, PhishMe, Slack, Lair), other custom-built security tools, and Capture The Flag (CTF) events!

Central InfoSec performs a variety of penetration tests including external-networks, internal-networks, web applications, and APIs. The company quickly informs clients of critical vulnerabilities by creating ad-hoc reports and hosting ad-hoc debriefs as necessary.

Best Penetration Testing & Security Consulting Firm

Central InfoSec Red Teaming
& Penetration Testing

Central InfoSec can quickly uncover critical vulnerabilities that have been missed for years. No automated scanning tool can replace high-quality security professionals. Utilizing Central InfoSec’s custom-built tools and manual analysis, Central InfoSec’s security experts have found numerous vulnerabilities within web applications including multiple 0-days allowing direct access to web servers hosting the applications. Once critical vulnerabilities are discovered, Central InfoSec’s experts work directly with application developers to address security flaws. With many success stories, Central InfoSec is constantly contributing to the community by sharing its knowledge through blogs, open-source projects, tool development, conferences, presentations, and local security meetups.

Every organization, at a minimum, should receive both network pen testing and web application pen testing, and cost should never be the reason that quality testing is not performed. Therefore, the company focuses on offering quality and affordable professional security services while increasing security awareness at organizations. The Central InfoSec team educates clients through security assessments and tailored security training while also helping with permanent resource staffing. We want to help organizations understand the core foundation to security, help businesses acquire the appropriate staff that they need, and help strengthen security postures through offensive security testing.

Best Boutique Pen Test Company

Central InfoSec strengthens the security posture of businesses by reducing cyber risk through red teaming and pen testing.

Best Boutique Pen Test Company

Let’s Work Together

If you’d like to see why Global 100 selected Central InfoSec as the Best Boutique Pen Test Company, let's have a chat to see how you could benefit from Central InfoSec security services. It’s simple and easy. We’ll even include a free customized quote. Let’s get started: Contact Us

Central InfoSec offers a variety of other professional security services to help you test, measure, and improve your overall security posture. Security services offered include red teaming, pen testing, vulnerability assessments, web app testing, managed phishing, and other tailored security services to help you reduce risk to your organization.