Penetration testing

Essentially, a vulnerability assessment is an automated scan used to identify vulnerabilities while a penetration test includes manual testing as well as automated testing, aiming to exploit those vulnerabilities to get a deeper understanding of the holes in your defences.

We’ve written a whole blog post on the subject: What's the difference between a vulnerability assessment and a penetration test?

PGI’s experienced, CREST, Offensive Security and Tigerscheme accredited team. All of our Penetration Testers have undertaken significant study, passed in-depth technical exams and been mentored before being allocated client work.

PGI is accredited to ISO 9001—the international quality standard—which ensures all of our processes remain of a high quality.

Typically penetration testing follows a set methodology. In simple terms, it might look like this:

• Reconnaissance, gathering information, and scanning to identify any potential exploitable vulnerability
• Safe exploitation of the vulnerability
• Expand access (or pivoting)—moving further into the network/system after finding an entry point
• Clean up so any exploits that were used are removed to prevent other attackers from using them

Along with their in-depth experience, PGI’s team use a wide range of tools to identify vulnerabilities, including industry best practice open source and commercial applications; they select the appropriate tools for the scope of work.

Testing will span anywhere from a week to a month, depending on the scope of work. For example, a simple website may take 2-3 days, while a more complex scope of work may take several weeks.

The threat is constantly evolving so penetration testing will only validate that your organisation’s IT infrastructure is not vulnerable to known issues on the day of the test. This is why testing should be performed regularly—many organisations commission quarterly or yearly tests.

If you are implementing any changes or new systems, infrastructure or applications, you will also need to test these before they are live. We strongly recommend not waiting until your next scheduled test to check that if there are vulnerabilities.

If you would like advice on how often you undertake a pen test, we recommend discussing this with one of our Information Assurance Consultants.

Any time you commission penetration testing you need to be sure it is conducted by qualified consultants who hold relevant and in-date industry qualifications and work for a CREST accredited company. Industry qualifications include: Qualified Security Team Member (QSTM/CSTM), Check Team Lead (CTL), Check Team Member (CTM), Senior Security Tester (SST), and Offensive Security Certified Professional (OSCP). PGI is a CREST accredited company and our Penetration Testers are CREST and Offensive Security certified.

On completion of the tests, the client can expect to receive the completed report within 5 days; however, any critical issues identified during the test will be immediately communicated to the customer. Any recommendations provided should be reviewed within the context of the business before implementing any remedial actions.

Almost all tests can be undertaken remotely, and we will always recommend the most cost-effective method. Please contact us to discuss your requirements.

As a CREST registered company, the PGI Red Team undertake penetration testing in organisations of all types and sizes under strict standards that minimise the risk of disrupting operations. Where possible, we carry out penetration testing on dev or test systems to avoid impact on production assets. Regardless of the system being tested, PGI consultants are always contactable during the test should a problem arise.

The cost is entirely dependent on the size of the systems or applications to be tested. Typical small to medium-sized organisations can expect to be quoted between 5 and 10 days of consultancy. This quotation may be significantly higher for larger organisations.