Penetration testing will show you what would the hacker attack on your systems look like. Our specialists will legally test the security of your IT infrastructure, or web and mobile application by applying real hacker tricks.

Why execute the testing?

You should not underestimate the need for testing. It will help you to uncover the weaknesses in your systems sufficiently early to prevent any potential damages. You will also be able to set-up your security process smartly according to the severity of errors and thus lower its costs. The type, scope, and method of testing are always selected after a joint consultation based on your needs and business goals.

Analysis report is the result, however, that is not the ultimate goal of our collaboration. We will be happy to design specific security methods for you after further consultations, and we offer help with their implementation. It is advisable to repeat the penetration testing because this is the best way to protect your data, investments, and your company reputation.

Collaboration process

Application testing

Nowadays, online applications are the core of business. Resources and time are spent primarily on their functionality, however, their protection is often underestimated or put off. Majority of applications is insufficiently secured, and weaknesses can be found already in their design. Our principal testing scenarios for web and mobile applications adhere to the OWASP methodology which covers over 90 security areas.

Web application penetration testing

Principal testing scenarios

Assessing the possibility of data leak.
Malware insertion options.
User identity misuse/theft.
Unauthorized access to systems and data.

The most common findings

Injection – malware smuggling, database theft.
Insufficient user account protection.
Cross-Site Scripting (XSS) – gathering login credentials.
Insufficient user rights authentication for important actions.
Outdated SW, misuse of known vulnerabilities.
Transferring sensitive data over unsecured channel, storage in open format.
Executing unwanted actions by an end user (CSRF).

Mobile apps penetration testing

Principal testing scenarios

Focus on possibilities of data leak and misuse in phone/tablet.
Assessing the security of application to server communication.
Attacks led from the public environment and internet.
Focus on the Android and iOS platforms.
Methodology and recommendations adhering to OWASP.

The most common findings

Insufficient API requests authorisation
Poor protection against the MITM (Man In The Middle) attacks
Access rights as part of the application code
Poor protection of sensitive data stored in mobile devices

Infrastructure testing

Having a perfectly secured and coded application is not enough. It also needs to run in a secured environment, otherwise your data may still be in danger. Therefore, the infrastructure testing serves to check out whether there are any of the known vulnerabilities inside your existing IT systems. One of the typical findings shows that outdated versions of network services with missing service packs are in use that can be used to the attacker’s advantage. Another common case we often encounter is the fact that companies are using outdated communication protocols which do not provide sufficient level of protection and integrity of the transmitted data.

Principal testing scenarios

Testing the target equipment – servers, network systems, firewalls, routers.
Identification of protocols and network services.
Verifying the possibilities of services misuse, system breaches, and data theft.
Exploitation – misuse of the discovered vulnerability, system control, obtaining admin / root access.

The most common findings

Network services with missing service packs with an identified exploit, see www.exploit-db.com
Using outdated protocols that do not provide sufficient level of protection and integrity of the transmitted data
Administrator interfaces with public access

Risk analysis

Is used to detect and identify security risks while introducing damage scenarios which could potentially occur after the error has been misused. All detected risks are scaled according to their severity and will give the management a tool for efficient definition of priorities within the software error removal process.

We will analyse the security of your current or newly built IT architecture or applications according to ISO/IEC 27001.
We will unveil vulnerabilities in your systems and evaluate their severity.
We will define the risks and recommend the best mitigation actions.
Risk analysis will help you to be GDPR compliant (General Data Protection Regulation) that became effective across EU starting May 25, 2018.

404