Cyber Penetration Testing

Penetration testing, also known as ‘pen testing’, involves evaluating a computer system, network, or web application to uncover vulnerabilities that an attacker might exploit, both externally and internally. This process assesses the likelihood of a successful attack on an organisation’s IT assets.

Engaging a pen tester to try to infiltrate your network serves as a method of gaining assurance of your defences, or, alerting you to how a hacker could potentially access your systems.

A pen test employs a carefully chosen array of tools and techniques to scrutinise an IT environment for weaknesses. The tester will assess the risk level associated with the identified vulnerabilities and evaluate the effectiveness of current security measures and configurations. This results in a report that outlines all identified security issues associated with specific assets and provides recommendations for remediation.

These are the steps performed to result in a successful penetration test:

• Planning – Defining scope, targets, activities, rules of engagement, timeframe, budget etc.
• Engagement – Confirmation of the start of testing, reiterate the scope and timeframe.
• Pen test activities – Reconnaissance, Scanning, Exploitation (if approved).
• Reporting – Collating the output of the activities into a single report, with both an executive summary of findings, and more detailed technical writeups including suggested remediation steps.
• Remediation – This is the responsibility of the client, although Toro can advise on actions needed.
• Re-testing – This is an optional activity to show that remediation has taken place and is effective.
• Review – This helps to understand if the client’s needs were met, and what the next steps are to help the client to reach their long term cyber security goals.