Get in Touch

Vulnerability Assessment & Penetration Testing (VAPT)

High Quality Penetration Testing.
Uncover weak spots before the hackers do.

Close the Door on Hackers

You might have heard of the phrases Black Hat and White Hat. Black Hat refers to cyber criminals, the bad guys trying to hack into networks and systems. The usual motivation is money. Can they make a fast buck selling your confidential data (for example, customer information or intellectual property) on the dark web? Can they plant Ransomware, preventing you from accessing important documents and then (they hope) extracting a good sum of money from you with a (sometimes false) promise they will decrypt the data in return? Maybe the intention is to install a backdoor – a way to silently access your systems remotely – so they can keep an eye on activity for weeks and months, springing a nasty surprise when the timing is right. Whatever the nature of the malicious intent, it can prove costly if a hacker manages to compromise your security. That’s where the White Hat community comes in handy. Not quite knights in shining armour (though we like the idea), White Hat is a label used to describe the good guys, the penetration testers and security analysts, whose job it is to help protect your systems. As the name suggests, vulnerability assessments and penetration testing are all about finding weak spots in your network and applications, which could act as potential entry points for the hackers. In some industries, in order to comply with relevant compliancy regimes – such as PCI-DSS – regular vulnerability and penetration testing is a necessity.

image

Network Penetration Testing

We carry out both internal and external network pen tests, so you can secure internal systems as well as those exposed to the internet. Depending on the scope, a black or gray box is conducted. An external black box PT typically mimics the path a hacker would take, with no prior knowledge of the network. Internal testing, amongst other benefits, can highlight the potential damage that could be caused by an insider, or other user with system access, who has malicious intent.

image

Application Penetration Testing

Applications often capture and handle sensitive data and can become a vector to infiltrate other systems. We thoroughly test web and mobile applications, ensuring vulnerabilities are swiftly identified, so action can be taken to resolve security weaknesses. Our teams assess a whole host of areas, including authentication, error handling, business logic and input validation.

image

Active Directory Assessment

Once a network is compromised, hackers can move to exploit security weak spots in Active Directory. Our assessment identifies points of concern in your Active Directory environment by running various attack simulations. A risk analysis is performed, and results are summarized in a report that neatly explains the vulnerabilities uncovered during the engagement, the level of risk they pose and remediation steps that can be taken.

image

Cloud Security Assessment

As cloud adoption gathers pace, and more sensitive data moves off premise, understanding how to secure that information becomes critical. The Cloud security assessment service uncovers security holes residing in cloud infrastructure, whether hosted on AWS, Azure or GCP.
Depending on the nature and level of your cloud use, and the agreed scope, we will robustly test applications, platforms and infrastructure. Our cloud assessment also includes container security, where we test deployments of Kubernetes.

image

PTaaS

Unlike a traditional pen test, which is a point in time engagement, our Penetration Testing as a Service is delivered on a continuous basis. Following the findings and recommended fixes listed in a VAPT report closes doors to attackers. But, since infrastructure isn’t static, new vulnerabilities can be introduced in a myriad of ways such as configuration changes, software and hardware updates or the emergence of previously unknown, zero day, exploits. Through our PTaaS, we become a trusted security partner, providing ongoing assessments so that new risks are immediately identified and mitigated.

We carry out both internal and external network pen tests, so you can secure internal systems as well as those exposed to the internet. Depending on the scope, a black or gray box is conducted. An external black box PT typically mimics the path a hacker would take, with no prior knowledge of the network. Internal testing, amongst other benefits, can highlight the potential damage that could be caused by an insider, or other user with system access, who has malicious intent.
Applications often capture and handle sensitive data and can become a vector to infiltrate other systems. We thoroughly test web and mobile applications, ensuring vulnerabilities are swiftly identified, so action can be taken to resolve security weaknesses. Our teams assess a whole host of areas, including authentication, error handling, business logic and input validation.
Once a network is compromised, hackers can move to exploit security weak spots in Active Directory. Our assessment identifies points of concern in your Active Directory environment by running various attack simulations. A risk analysis is performed, and results are summarised in a report that neatly explains the vulnerabilities uncovered during the engagement, the level of risk they pose and remediation steps that can be taken.
As cloud adoption gathers pace, and more sensitive data moves off premise, understanding how to secure that information becomes critical. The Cloud security assessment service uncovers security holes residing in cloud infrastructure, whether hosted on AWS, Azure or GCP. Depending on the nature and level of your cloud use, and the agreed scope, we will robustly test applications, platforms and infrastructure. Our cloud assessment also includes container security, where we test deployments of Kubernetes.
Unlike a traditional pen test, which is a point in time engagement, our Penetration Testing as a Service is delivered on a continuous basis. Following the findings and recommended fixes listed in a VAPT report closes doors to attackers. But, since infrastructure isn’t static, new vulnerabilities can be introduced in a myriad of ways such as configuration changes, software and hardware updates or the emergence of previously unknown, zero day, exploits. Through our PTaaS, we become a trusted security partner, providing ongoing assessments so that new risks are immediately identified and mitigated.

Our Methodology

Our team will work closely with you to advise and define the scope of what is to be tested. We’ll lean on our experience to make suggestions – the objective is to ensure any assessment is as meaningful as possible. Once the scope is clear, our Pen Testers will use a mix of automated and manual analysis to conduct the test. Though there are many generic and custom tools available, our team prefer to rely more on their own knowledge and skill set. To make the test as comprehensive as possible, Pen Testers need to think out of the box – essentially think like a Black Hat – so that no stone is left unturned. Upon test completion, we will deliver a detailed report, listing findings and recommendations. And we’ll follow that up with a retest to ensure identified weaknesses have been fixed.

Planning and preparation

Planning and preparation

In the planning stage, the scope and goals of the project are defined. This includes the type of VAPT exercise to be undertaken, the target systems, planned duration, testing framework, and other considerations. It is important for both parties to discuss and agree how the activity will be conducted on a high level, taking into account various factors that can have a direct and indirect impact on the effectiveness and success of the project. For example, whether a staging environment is to be utilised, how to communicate critical vulnerabilities if any are discovered during project execution, to what extent vulnerabilities are to be exploited, and so on.

Passive & Active Reconnaissance

Threat Modelling

A crucial part of any penetration testing engagement is the carrying out of thorough research. Knowledge of the organisation and its target systems and networks is fundamental to the success of the whole exercise. Depending on the nature and the objectives of the penetration test – for example, whether a black box test is to be carried out, or if an application is to be assessed instead of network assets and infrastructure – appropriate information is gathered and scrutinized from multiple sources. Activities such as mapping the external attack surface and determining potential weak points help the testers evaluate which tactics and techniques to employ.

Execution

Scenario planning

The various activities that form part of the execution phase depend heavily on the scope and nature of the test. Some typical steps at this stage include:
• Assessing the target systems for vulnerabilities
• Attempting to exploit discovered vulnerabilities with a view to gaining unauthorized access
• Aiming for initial administrator-level access, or seeking to elevate privileges to administrator level, in order to facilitate lateral movement throughout the network
• Identify and obtain access to critical data and systems
• Ensure compromised systems remain accessible for the duration of the test period
• As appropriate, removing traces and footprints of attacker activity and restoring the system to a clean state

Reporting

Execution

During the assessment, the testing team meticulously note and record the steps that have been taken along with results and other pertinent information. These are subsequently analysed and form the basis of the report, which is comprehensive in nature but designed to be accessible to a range of audiences. The report neatly summarises the findings – for example, which vulnerabilities were exploited, how this was done, what the severity level is - with key information highlighted and priority items categorised and emphasised as necessary. Advice and insight into remediation steps for vulnerabilities is given. Where appropriate, the report also seeks to offer advice, such as recommended best practices. Organisations gain an excellent overview of the potential holes in their defences, allowing them to move quickly and mitigate against threats that might seek to leverage these vulnerabilities and compromise their valuable systems and data.

Why Us

All of our VAPT engagements are based on industry standards and have been further developed to ensure we deliver a comprehensive a service as possible. These benchmarks include OWASP, NIST, PTES and OSSTMM. Our fully certified experts are highly technical, with years of extensive experience, having worked on a breadth of projects. Certifications held by the team include OSCP, CPSA, CEH and CRTP.

Detecting Advanced Threats & Safeguarding Your Business

Get in touch. We'd love to hear from you.

    Circumvensys is a managed security services company on a mission to offer simple and effective solutions. No nonsense Cyber Security. For everyone.

    Contact Us

    Get Connected

    Facebook-f Instagram Linkedin
    © 2023 Circumvensys | All Rights Reserved | Privacy Policy