Penetration Testing for Small and Mid-sized Businesses

Penetration testing is a form of ethical hacking that seeks to pierce a company’s cyber defenses to find exploitable vulnerabilities in networks, web apps, systems and user security. The key objectives of penetration testing include:

• Identify exploitable issues so that effective security controls can be implemented

• Test the robustness of an organization's security policies

• Assess a company’s regulatory compliance status

• Check the company’s employees' security awareness

• Evaluate the company’s ability to identify and respond to security issues and incidents

Penetration testing by credible experts should always be built upon frameworks and best practices from industry-recognized organizations such as the National Institute of Standards and technology (NIST), Center for Internet Security (CIS), the PCI Council, the Payment Card Industry’s Data Security Standard (PCI DSS), and the SANS Institute (officially the Escal Institute of Advanced Technologies).

Our Freed Maxick Penetration Testing methodology looks like this:

There are many different resources that go into greater detail on the costs, components, processes, and benefits of penetration testing. (For example, see Cipher.com’s “The Top 25 Reasons Why You Should Pentest”).

In today’s post, our focus is upon what we consider to be one of the early phases, and perhaps the most critical part of the penetration testing– Discovery.

Brief Overview of the Discovery Phase of Penetration Testing

In the context of cybersecurity, discovery is the practice of covertly identifying and collecting information about an organization, its networks, systems and overall external presence. Hackers will typically do reconnaissance to find points of entry for their attack, such as file permissions, running network services, OS platform, trust relationships, and user account information. This information is used to create the plan of attack for a hacker.

More than ever before, you need to put yourself in the hacker’s shoes and determine, though reconnaissance, your business’ vulnerabilities, how hackers might exploit them, and what you need to do to close or shut down those opportunities.

There are many types of reconnaissance techniques or “foot-printing” deployed in discovery, that are generally used for information gathering.

“Foot-printing” of external systems is one of the techniques that help to determine the amount of information available through public sources concerning your organization. Once gathered, an attacker will then determine the value of the information obtained through the foot-printing process that could further his/her efforts to compromise your network. The reconnaissance or foot-printing process can include, but is not limited to, the following activities:

• Online telephone directory searches
• Website(s) reviewed for information-gathering potential
• Mapping of domain names used
• Mapping of domains linked to your domain names used
• Web searches performed to discover any private or sensitive information available through public sources
• American Registry of Internet Number searches
• Domain Name Service lookups
• Traceroutes of public systems

Sources for this information cannot always be removed by an organization because the information is your company’s presence to the public. These become the stepping stone for a possible attack plan.

Penetration Testing Services for Small and Mid-Sized Businesses

Have questions about your company’s cybersecurity defenses, or want to discuss penetration testing services in greater depth? Contact David Hansen, Director of Risk Advisory Services, for a complementary 30-minute cyber consultation. He can be reached directly at 585-360-1481 or David.Hansen@FreedMaxick.com.