External penetration tests are one of the most common tests we perform. An external penetration test is often the starting point for any company that is trying to understand its risk. With numerous compliance regulations (PCI, GDPR, HIPAA, CMMC, etc) either requiring external penetration tests or “highly recommending” them, we get to perform a lot […]
An external penetration test evaluates the perimeter security of your organization by simulating an attacker on the internet. The goal is to identify vulnerabilities in internet-facing systems, attempt to breach internal networks, or uncover publicly exposed information that could harm your reputation. (For more details, see our complete external penetration test guide.) Because it closely […]
When most people think about penetration testing, or securing their network in general, they tend to focus on their external perimeter that is exposed to the Internet. But as an organization matures from a security perspective and wants to truly understand their risk, they have to look at their network from other angles. The next […]
If you are a level 1 merchant or service provider, or your acquiring bank views your organization as high risk, you must be compliant with the full Payment Card Industry (PCI) Data Security Standard (DSS). Additionally, in order to validate your compliance, you will be required to have a Qualified Security Assessor (QSA) perform a […]
As we have previously discussed, it is often times difficult to justify the budget and quantify the return on investment for a penetration test. While we always recommend ensuring your firm is conducting a reasonable amount of testing with a sufficient scope to maintain a stable security posture, we recognize that sometimes the budget and […]
Unlike the financial analysis of a “normal” project or investment, it is tough to ultimately determine the return on investment of a penetration test. We like to relate a penetration test to your annual physical with your doctor. You go to your doctor to get a check-up as a preventative measure with the hope that […]
Social Engineering is one of the most important tests you can have performed because it evaluates the largest risk to your organization. In 2018, 83% of organizations faced a social engineering attack, so it is very likely that this is a threat you are going to continue to see in the new year. Because of […]
Host compliance audits are known by a lot of different names. Configuration reviews, security reviews, configuration audits, and host checks are just a few names I’ve heard tossed around to describe a review of the level of security of a workstation/server/device. This is done by using a combination of a best practice standard and a […]
A wireless penetration test is a holistic review of your wireless environment and the risk it presents to your organization as a whole. This assessment includes tactical testing that determines whether an attacker in the parking lot can gain access to your corporate network through your wireless signal. However, in contrast to other penetration tests, […]
Could an attacker physically gain access to your office and attack your network from inside? Could they gather sensitive information from employee desks or conference rooms? Could they gain access to your server room? A physical penetration test is designed to answer all of these questions over the course of roughly 3 days onsite at […]
