PENETRATION TESTING SERVICES IN THE UK

Pen testing methodology defines the depth and breadth of how and on what basis test cases are generated.  Cyphere’s pentesting engagement methodology , also known as Vulnerability Assessment and Penetration Testing (VAPT), is broken down into five phases:.

1. Initial Scoping & Objectives Agreement : This is a conversational phase to go through pain points/primary security concerns and discuss on the assets in scope, out of scope and the objectives for the security test. Communication protocols, fragile components, third party service providers authorisation, pre-requisites and planning falls into this phase. 
2. Reconnaissance : Recon process involves collecting information about the target network, application, systems or devices as much as possible. This sets the ground for attack layout preparation.
3. Scanning : This is an activity aimed at finding what services (such as email services, web services hosting applications, file transfer services/protocols) are running on each of the targets in scope. Activities such as network mapping, service enumeration, vulnerability scans are part of this phase. 
4. Exploitation : Vulnerability exploitation phase involves exploiting the identified vulnerabilities to measure the extent of breach of a security vulnerability. It is performed in a controlled manner, keeping in view the fragility of the assets ins cope and agreed objectives. Password testing (cracking & analysis) , vulnerability research, lateral movement, post-exploitation activities belong to this section. 
5. Reporting : This is amongst the most important parts of any security test. Information must make sense to customers investing their time and resources. All our reports include raw data, supporting screenshots, tactical and strategic recommendations, management reports and technical reports. There is a debrief call at the end of every security assessment to ensure customer has understanding of the findings and have a remediation plan in mind.
6. Remediation : This is an optional remediation consultancy to help mitigate risks identified during penetration testing. Due to security skill-set and environment complexities faced by organisations, our approach involves risk focussed approach towards risk remediation.