Penetration Testing Services
Learn what vulnerabilities are exploitable in your environment and the level of impact they can have
Penetration Testing Methodology
Our expert penetration testers simulate real-world threats that model typical attack tools, techniques, and objectives in order to attempt to exploit cyber security vulnerabilities. Going through the stages of the attack kill chain, such as reconnaissance, delivery, exploitation, and actions on objectives, we have the capabilities and experience to simulate a complete malicious targeted attack. Our detailed analysis and recommendations to remediate or mitigate validated vulnerabilities provides valuable insight into the level of risk posed to an organization and their clients and partners.
​
NIST Framework Penetration Testing Methodology
Our team aligns our Penetration Testing services with the highly respected NIST Framework. Below is a general outline of NIST's penetration testing methodology:
​
-
Planning and Reconnaissance
-
Research and gather information on the target, plan attacks
-
Verify in-scope systems and basic information, such as operating systems in use
-
-
Vulnerability Identification
-
We use industry standard commercial vulnerability scanners, such as Tenable Nessus​
-
Polito manually validates the vulnerabilities detected to determine if they're false positives or not applicable
-
-
Vulnerability Exploitation
-
Manually validated vulnerabilities are exploited by our expert team of ethical hackers
​
-
-
Documenting Findings
-
Our team documents our steps taken, findings, remediation/mitigation recommendations and other relevant information into a formal report​
-
We also conclude our penetration testing engagments with a formal outbrief to review the final report and answer client questions​​
-
Pen Testing Services
-
Custom web apps
-
Modified off-the-shelf (MOTS) apps
-
Commercial off-the-shelf (COTS) apps
-
Hardware security
-
Software security
-
Wireless and network connectivity
-
Facilities (offices, manufacturing plants, warehouses, etc.)
-
Security personnel, processes, and procedures
Routine penetration testing of external and internal networks is highly recommended for all organizations. This fundamental cybersecurity practice goes beyond a basic vulnerability assessment by attempting to exploit validated vulnerabilities.
Web application penetration testing is a process that verifies that the information system protects the data and maintains its intended functionality. Active analysis for any weaknesses, technical flaws, or vulnerabilities becomes especially important if the application contains credit card information or identity data, as the initial compromise may be all that the attacker needs to obtain that information.
Polito’s mobile assessment approach will provide your organization insight into how well your mobile applications protect sensitive information from attacks by inspecting every component through application architecture review, web service assessment, secure Software Development Life Cycle (SDLC), and web application testing to identify potential vulnerabilities.
The advent of IoT devices has created yet another attack vector, and one that requires a diverse set of skills in order to properly test for security vulnerabilities. These devices combine hardware, software, sensors, and various wireless and networking technologies, which must all be tested in order to secure them and the data that can be accessed by them.
Physical penetration testing allows organizations to understand how susceptible their facilities are to a security threat. This type of penetration testing typically includes assessing the effectiveness of a clients' security systems, CCTV, locks, mantraps, bollards, employee/vendor/guest check-in process, security guards, and more.