Many of our clients come to us when a client or third-party vendor requires a penetration test, and they have to provide proof to them that they have completed a penetration test. The conversation ranges from “I have no idea where to start” to “what the heck is a penetration test” to “we currently conduct […]
Threat modeling is a term thrown around in a lot of different contexts, but it can sound daunting if your unfamiliar with it in practice. It really just refers to identifying what threats an organization, a target network, or an in-scope application should be worried about. For penetration testers, you are modeling (mapping out) the […]
In today’s blog, we are going to learn a key concept related to how an attacker gains a foothold on your network: the difference between a bind and reverse payload. Attackers typically get an initial foothold by exploiting a vulnerability that allows them to execute code on a target. This can be through a web […]
With the rise of the Internet of Things (IoT) and Internet-connected devices becoming more pervasive in every organization, it makes sense that there’s been more done to assess the risk and implement security controls for these devices. Both the organizations that produce IoT devices and the organizations that incorporate them into their networks have responsibilities […]
We discussed last week that open source intelligence, or OSINT, is one of the most important phases of an assessment for a penetration tester. It is this part of a test where an engineer is gathering background information about an organization that is publicly available, ranging from the business they are in, to the types […]
Penetration testing requests for proposals (RFPs) or requests for quotes (RFQs) can be a great way to bid on and potentially win penetration testing projects as a business. Many pen testing vendors rely on capturing business solely, or mostly, through RFP submissions. Most RFPs are for government entities such as local municipalities, state run schools, […]
In today’s blog, we are going to explore the concept of Black Box vs. White Box testing. There are a lot of terms thrown around when it comes to security, and it is easy to get confused, especially when different sources use different definitions for each term. Not to worry, we’ll explore black box, gray […]
Penetration tests can range from a simple test that takes 1 day to complete up to an assessment with multiple different penetration testing services that takes weeks to complete. A project manager is a vital role during a penetration test to ensure that everything goes smoothly, timelines are met, and ultimately the client gets the […]
As companies prepare for the January 1st, 2020 implementation of the California Consumer Privacy Act or CCPA, we have been fielding quite a few questions surrounding the new regulation and its requirement for “reasonable security”. One of the most often asked questions is “Does the CCPA require penetration testing?” Today we dive deeper into the […]
Many times we have organizations come to us that have never had security assessments or penetration testing performed before. Maybe they have a new compliance requirement that is pushing them to get some testing done, or maybe they keep hearing more about the benefits of penetration testing and feel they need to jump in and […]
