Social engineering assessments
Social engineering is an attack that requires human interaction, persuading employees of the target company to act, such as opening a malicious document or providing authentication credentials.
External penetration testing simulates a persistent outside attacker. We use two different models when conducting external penetration testing:
In any case, after the scope is defined, we use the same methodology for both models, covering different types of attacks, misconfiguration, and security flaws.
Internal penetration testing implies that the attacker has either insider access or has successfully breached the perimeter. However, unlike adversary simulation assessments, a complete simulation focusing on stealth, evasion, and lateral movement in the network is not performed as a part of the internal penetration test. Instead, the testing team focuses on identifying as many potential attack vectors and compromise paths as possible, partially giving up attack realism to expand the testing coverage.
Thus, the penetration testing team is provided network access to all segments that need to be tested and basic relevant information about the environment and the segmentation of the infrastructure is tested separately, covering both network and service layers of the infrastructure while being more time-efficient.
Infrastructure penetration testing assessments are very different between customers, but we use a repeatable and reliable structure for our tests. The step-by-step approach ensures consistency in key areas while being flexible enough to account for different attack environments and scenarios. The infrastructure penetration testing consists of the following steps:
In the case of a BlackBox external penetration test, different OSINT techniques are used in order to identify the potential attack surface.
Both network and application security scanners are used to map the attack surface and gather information about in-scope applications and services.
Scanning results are reviewed and the penetration testing team manually searches for security flaws and misconfigurations that can be potential vulnerabilities.
Security flaws vulnerabilities are exploited in order to assess their security risk and potential to be used in a chain.
The vulnerabilities validated on the previous stage are chained, if possible, to create potential attack paths that can lead to compromise.
After conducting all of our penetration testing activities, we create a comprehensive report describing discovered vulnerabilities and attack paths. Once the report is reviewed, a debrief meeting is scheduled to answer any questions and elaborate on the details in the social engineering report.
Social engineering is an attack that requires human interaction, persuading employees of the target company to act, such as opening a malicious document or providing authentication credentials.
Tenendo code review approach leads to detecting many vulnerabilities in real-world software and achieving amazing results, in comparison to other approaches.
Discovering potential compromise paths. Test threat response, detection, and investigation processes.