- Networking and Security
- Juniper
- Websense
- Training Courses
- Security Consulting
Penetration Testing
The ‘Penetration Test’ is a live test of the security defences of a network. Our team of specialists uses techniques and exploits that real-life hackers would use to simulate the results of an attack. Members of our consulting team focus on their own area of expertise.
Penetration testing helps an organisation determine their level of network security and vulnerability and identify weak elements that need to be repaired. It can aid in evaluating an organisation’s detection and response capabilities and help determine whether the proper controls are in place.
We have found that most networks have vulnerabilities serious enough to allow the network to be completely compromised, but that most of these vulnerabilities can be identified through Penetration testing, addressed and corrected. For most organisations, the risks of not identifying serious security flaws are unlimited and the losses can be enormous.
In the same way that most software is beta tested by live users, Penetration Testing is an established technique for the live testing of network security. Many organisations use Penetration Testing on a regular basis to continuously evaluate their security status.
Quantix’s consultants keep up-to-date with the most recent exploits and vulnerabilities. Since new exploits are discovered daily, IS managers and network security administrators need to be continuously vigilant. Penetration testing is a valuable testing, auditing and evaluation tool. For some organisations, network security is an important marketing element. In these cases, having a comprehensive audit by an outside third party, such as Quantix, can provide a sense of objectivity and reliability to the analysis.
Testing Severity
Tests are not simulations but replicate actual attacks, therefore, different levels of testing can be performed. Non-invasive tests or actual Attacks, Crash or DoS tests which may impact operations.
Impact Levels
Non-Invasive/passive Type (Operational Impact: None)
• Gain Root – exploits than enable root access
• Info Gathering – Information used to help gain access
Invasive Type (Operational Impact: Possible)
• Attack
• DoS – Denial of Service Crash
Recommended Testing Procedure
Passive test first
- Identify Existing Vulnerabilities.
- Plan fixes and implement
- Re-test – prove vulnerabilities resolved
- Harden server prior to invasive tests
Invasive (may impact operations)
- Attack, DoS, Crash
- Ensure BCP is obtainable/achievable
- Test backup/standby machine
- Identify & fix vulnerabilities