External pentest

What is an external pentest

Attacks on IT infrastructure most often occur through the external perimeter. An attacker exploiting vulnerabilities in IT infrastructure components gains access to sensitive information.

Frequently Asked Questions External pentest is to simulate the actions of an attacker who attempts to penetrate the IT infrastructure from the outside and gain access to protected information. In general, external penetration testing is performed using the Black box model (the pentester has no information about the Client's IT infrastructure).

When you need testing

When reviewing the security of the IT infrastructure

Pentest can help you test how secure your infrastructure is not only in theory, but also in practice

In fulfilling the requirements of the regulators

Pentesting is a mandatory requirement according to PCI DSS, 719-P, 683-P, 757-P, 742-P, 802-P and GOST R 57580

After making significant changes to the IT infrastructure

The pentest can be used to identify new vulnerabilities that have arisen since the infrastructure upgrade

What you'll get

Summary

A general description of the pentest results without using specialized terminology, but with an assessment of the criticality of the identified vulnerabilities.

Technical report

Contains information about the vulnerabilities found, how they are reproduced and scenarios of their exploitation. The Report also contains detailed information on how to remediate the found vulnerabilities.

Expert opinion

This section contains information on individual ways to improve the level of information security taking into account the Client's business processes.

How to use the Pentest Report

01

Analyze the results

Carefully review the Report to understand the identified vulnerabilities, potential impacts, and recommendations for remediation.

02

Develop an action plan

Create an action plan to address identified vulnerabilities. Establish timelines and responsible parties to ensure an appropriate response to each issue.

03

Fix the vulnerabilities

Take measures to address identified vulnerabilities in accordance with the developed action plan

04

Repeat the test

After the vulnerabilities have been fixed, repeat the pentest to ensure that the issues have been successfully fixed and the system is now secure.

05

Update policies and procedures

Based on the results of the pentest, update security policies and procedures.

06

Staff training

Conduct employee training to raise awareness of risks and security best practices

In external pentesting, we use

Nessus and Burp Suite network scanners, Nmap and many other utilities from the Kali Linux distribution

Manual testing. Applying the skills, experience and knowledge of our specialists, not just scanning the perimeter

Specialized software of own development

Benefits of ITGLOBAL.COM Security

1/5

Certificates

External pentest is performed by specialists who have international certificates: OSCP, OSCE, OSWE, CEH

.

2/5

Adherence to standards

PCI DSS, 719-P, 683-P, 757-P, 742-P, 802-P and GOST R 57580

3/5

Proprietary testing methods

Having more than 30 proprietary external pentesting methodologies

4/5

Post-service support

We continue to advise you after the pentest to help address vulnerabilities identified in the process

.

5/5

Proven experience

10 years of practical experience, real cases of our clients and all necessary FSB and FSTEC licenses

Frequently Asked Questions

What is a pentest?

A pentest is a method of assessing the security of IT infrastructure or information systems using techniques and tools similar to those that attackers might use
Types of pentests

External pentest is a simulation of the actions of an attacker who has illegally penetrated the IT infrastructure from the external environment
Internal pentest is a simulation of the actions of an attacker, from the perspective of an internal user or employee who has access to the IT infrastructure or information systems
Web application pentest is a simulation of the attacker's actions aimed at identifying vulnerabilities that can be exploited to gain unauthorized access to data, functionality or resources of a web application.
Pentest of a mobile application is a simulation of an attacker's actions aimed at identifying vulnerabilities that can be exploited to gain unauthorized access to data, functionality or resources of a mobile application.

What are the techniques for conducting pentests?

White Box - simulates the actions of an employee who holds a responsible position and has specialized skills.
Gray Box - simulates the actions of an employee with basic access to the company's infrastructure and services.
Black Box - simulates an attack by an attacker who knows nothing about the company's infrastructure, only its name.

How does pentest differ from security analysis and IS audits?

Security analysis allows you to find all known and unknown vulnerabilities in your IT infrastructure IS audit allows you to assess the current state of the Client's information security processes and get an objective assessment of their maturity Pentest allows you to find all known and unknown vulnerabilities in your IT infrastructure and perform attacks using them.

Our clients