CREST-Accredited Penetration Testing Services
CREST-accredited penetration testing services from IT Governance, a GRC Solutions company
As a CREST member company, IT Governance, a GRC Solutions company, can give provide technical assurance that your cyber defences are effective.
Our experts will analyse your cyber security vulnerabilities to protect your organisation from cyber crime and data breaches.
Our penetration testing services
Our fixed-price testing packages are suitable for any organisation that wants to identify vulnerabilities targeted by cyber attackers.
Results are presented in a report that is ideal for small and medium-sized organizations with no prior security testing experience.
Remote working penetration tests
Remote Access Penetration Test
Our Remote Access Penetration Test combines a web application and infrastructure test.
Performed remotely, it assesses your externally facing remote access solutions, looking for:
- Inadequate/insecure authentication;
- Weak configurations;
- Default settings; and
- Outdated software and patching levels.
Remote Compromise Penetration Test
Our Remote Compromise Penetration Test will identify:
- Weak configurations (e.g. default settings);
- Outdated software and patching levels;
- Insecure authentication;
- Weak permissions; and
- Means of bypassing antivirus software.
Infrastructure (network) penetration tests
Infrastructure tests probe for security flaws affecting your operating systems and network architecture, such as
- Servers and hosts;
- Firewalls and wireless access points; and
- Network protocols.
There are two types of tests: external and internal.
Social engineering and phishing tests
Social engineering involves attackers manipulating victims into compromising their security, transferring money or providing sensitive information. A social engineering penetration test will assess your staff’s susceptibility to phishing and other types of social engineering.
Social engineering penetration tests
Social engineering penetration testing highlights vulnerabilities involving your employees and helps inform appropriate staff awareness training.
A Social Engineering Penetration Test will help you:
- Establish the publicly available information that an attacker could obtain about your organisation;
- Evaluate how susceptible your employees are to social engineering attacks; and
- Determine the effectiveness of your information security policy and your cyber security controls at identifying and preventing social engineering attacks.
Phishing penetration tests
A Simulated Phishing Attack establishes your employees’ vulnerability to phishing emails and helps inform appropriate staff awareness training.
We send emails to your staff asking for sensitive information, such as usernames and passwords.
We will then assess their responses and create a report to help you understand where to focus staff training.
Other penetration tests and scanning services
Wireless tests examine security vulnerabilities affecting your wireless networks, including:
- Information leakage and signal leakage;
- Encryption vulnerabilities, such as wireless sniffing and session hijacking; and
- Weak access controls.
Web application tests identify security vulnerabilities introduced during the development or implementation of software or websites, including:
- Assessing web applications for vulnerability to attacks, such as XSS (cross-site scripting);
- Confirming the secure configuration of web browsers and identifying features that can cause vulnerabilities; and
- Safeguarding web server security and database server security.
Cloud configuration tests:
- Identify vulnerabilities and security misconfigurations in the defined Cloud infrastructure;
- Attempt to exploit any identified vulnerabilities;
- Create an ordered list of issues and their associated risk; and
- Provide remediation advice for identified vulnerabilities.
A Red Team Assessment is an investigation of an organisation’s security and defence against cyber attackers. The ‘red team’ is composed of experienced penetration testers. They will use any methods at their disposal to non-destructively gain access to your networks, systems and information.
Simulating real attacks from a threat actor’s perspective can:
- Provide an understanding of how an attacker sees your organisation and attack surface;
- Establish clarity around all potential targets such as critical assets; and
- Assess your detection and response capability.
Attack scenarios can be crafted to emulate specific types of threat actor. We use traditional and non-traditional techniques to test your resilience to intrusion, fraud, data extraction, internal threats, corporate espionage and physical attacks.
How GRC Solutions can help you
Companies using our penetration testing services
