|
In a penetration test instead of simply examining a system
or application for potential vulnerabilities, one of IRMs
security cleared teams will attempt to gain illicit access to
protected resources and exploit any underlying vulnerabilities.
In doing this the team will use the precise methods and tools
that are in practice employed by 'real' hackers and computer
criminals.
To do this we build a 'Scenario' of the type of person and
the type of activities that might be targeted at the client's
infrastructure. This might be of an ill-informed external hacker
or perhaps of a disgruntled insider; it might even encompass
a determined criminal willing and able to gain illicit physical
access to a building. IRM audit engineers have enacted these
and many other extreme scenarios so as to provide a realistic
appraisal of information security.
A precisely defined engineering methodology is applied by
the audit team. This allows vulnerabilities to be identified
and isolated, allowing necessary intrusion tools to be obtained
or developed. This then ensures that access is gained in a safe
and controlled manner - be that physically or logically.
Throughout this intrusion exercise the audit team will endeavour
to understand precisely how a 'real' hacker would feel about
the information obtained: would they be excited or disappointed,
optimistic or pessimistic about their prospects of gaining entry;
in other words, quite apart from whether they would succeed,
would they hope to succeed in gaining access?
By using the same tools and approach as a hacker would, the
penetration test audit team can provide clients with a precise
idea of the 'view from the hacker's eyes' into the target system.
In this way we can help clients to ensure that not only are they
secure but that they are demonstrably secure, thereby assisting
in deflecting or deterring the hackers' attentions from the client's
computer infrastructure.
As an output from the penetration test, the client receives
a detailed report indicating not only the vulnerabilities but
also recommendations for the ways in which the overall security
of the targeted infrastructure can be improved.
|