Penetration testing, or pentesting, is an independent and objective security assessment which simulates real world attacks on an IT system be it a web application, mobile application, internal network or external network.
In the past few years cloud penetration testing has become increasingly in-demand, whereby the cloud system’s strength and weaknesses are evaluated, with the ultimate goal of strengthening the cloud’s overall security posture. Cloud penetration testing aids in detecting threats, risks, weak points and any possible gaps. The impact and effects of exploitable vulnerabilities, can be devastating to organisations.
At Cybergate we utilise the same penetration testing tools and techniques as real-world hackers do to offer comprehensive security assessments. These assessments are tailored to your environment and organisational needs, clearly highlighting the security shortcomings whilst providing actionable remediation advice to improve your overall security posture.
A pen test by Cybergate can be performed on any of the below and by exploiting multiple attack verticals.
Physical security breaches are frequently undervalued.
Companies understandably want to protect their digital data by strengthening the security of their digital assets, such as web applications and infrastructure. While this is critical, one should never dismiss the possibility of a physical attack that could completely circumvent digital security mechanisms. An attacker could physically enter the building and steal equipment such as laptops, infect machines with malware, or even plant a rogue machine on the network from which they could remotely access the internal network for further attacks.
Cybergate performs Physical Penetration Testing in accordance with ISO27001:2013 Annex A.11.1. It is intended to assess the effectiveness of your company’s current physical security controls and to identify weak access points that could be exploited by intruders or rogue employees. Doors, locks, emergency exits, sensors, security gates, and loading areas are just a few examples.
Our physical assessments are performed by trained security officials in order to:
- Expose the level of real-world risks
- Expose the weaknesses in the Office Infrastructures and Buildings
- Protect against External & Environmental Threats
- Work in Secure Areas
- Provide actionable recommendations to mitigate the identified flaws in a safe and controlled manner.
Frequently Asked Questions
A physical penetration test ensures that your office and its physical assets are safe from theft by malicious actors. These assets and the data contained within them are critical to your organization and, in the wrong hands, can be used to disrupt it. Furthermore, competitors would have an unfair advantage with this data at their disposal.
The cost of a penetration test is directly proportional to the amount of effort and time required to assess the physical resilience of the area(s) in scope.
A cyber security strategy should address all cyber-related risks and avenues that may jeopardize data security, including physical security. What good are firewalls and other digital security products if an attacker can simply walk into an office and connect to the internal network or steal sensitive documents containing the information?
As a rule of thumb, a physical pentest should be performed in the following situations:
- Just before the company begins to use the office space;
- Following significant changes to the office space, such as the construction of a new physical extension or the installation of new physical security equipment; and
- At least once a year to ensure that new personnel, both regular employees and security guards, are alert.
The following are the top issues based on our extensive experience conducting these assessments:
- Employees’ lack of awareness of cyber-security issues;
- Even when CCTV and cameras are installed, there is a lack of real-time monitoring and surveillance; and
- Doors to sensitive areas that are kept unlocked.
The length of a physical penetration test engagement is determined by the number of sites included in the scope and their size. The following are the main steps in this assessment:
- Building Plan and Access Control Policy Review
- Passive Reconnaissance and Open Source Intelligence
- Surroundings Review – Active Reconnaissance and Observations
- Planning of Attack Paths
- Exploitation:
- External to Internal
- Internal to Secure and Sensitive Areas