Cygnia Vulnerability Scanning & Penetraion Testing

What is Vulnerability Scanning and Penetration Testing?

Vulnerability scanning solutions allow organisations to determine if they have any security risks in their infrastructure setup. This may be a configuration error or a weakness in a certain application, etc. Scans can be conducted regularly and after changes to minimise vulnerabilities, they are generally non-intrusive.

Penetration testing can be done externally trying to enter in to the business or internally to see what may be at risk on the LAN. The test simulates a hacker attack and once a vulnerability has been identified, a pen tester then tries to exploit that vulnerability to see what the risk maybe, it is this exploitation by a person that differentiates Pen Tests from Vulnerability Scanning. Many auditors require a pen test as part of their assessment.

Vulnerability Scanning

Cygnia work with Outpost 24 Vulnerability Scanning Provider:

Outpost 24 offer leading proactive security solutions in the areas of Vulnerability Management, Web Application Scanning and PCI Compliance. Outpost24’s advanced and complete technology solutions of cloud based services and agent-less appliances are easy to implement, highly intuitive and accurate, providing the lowest possible total cost of ownership (TCO).

Penetration Testing

Cygnia works with a number of penetration testing providers:

Cygnia works with a number of Penetration Testing providers. Our partners are accredited to the highest standards within the UK and hold the CESG’s CHECK and Tiger Scheme accreditations. Our partners can do external gateway , internal network, application, wireless and social engineering tests.

Honey Pot Traps

Honey Pot traps lure hackers to compromise them and alert you they have accessed the network once they have evaded your security:

Today many companies have an Intrusion Detection System installed however in practice these can be poorly monitored, take significant amounts of time to both keep updated with the latest signatures and to remove false positive alerts from the console.

In order to detect potential incidents as early as possible, and to provide valuable early data on the nature of any such intrusion, it is possible to install a honeypot; this is a system which has no business function and whose sole purpose is to alert the IT department if there is an intruder scanning the internal network. In this way, it complements any traditional IDS that the company has installed. Once an alert has been received the IT team can correlate the particular alert data with any information from the IDS or other systems deployed to verify and react to the incident quickly.

The PTP solution uses proven open source technology to create an analogue of a Windows server, with a customisable range of services such as database, file sharing services or web servers. This will attempt to capture any payloads from automated network malware. The snort intrusion detection system is used to report on any activity investigated against the honeypot and this is emailed to the IT team(or any company managing your security) as an alert as soon as any connection a4empt is detected. Thus allowing you to react to a live threat – in real time!

The system can be custom-compiled on top of a Debian or Ubuntu Linux VMware image, or a pre-built image can be supplied for importing into ESX Server via the VM Converter tool.
Alternately, physical hardware or other virtualisa3on technologies can be supported.

Brand Damage Protection Service

The modern hacker has more techniques at their disposal than just scanning your gateway looking for valunerabilities. These can cause significant "Brand Damage" to yopur organisation:

The Modern Hacker knows you have Firewalls, IPS, Web and Email Content Scanners on the gateway and after they have checked there are no vulnerabilities in any of these systems they are going to look for other vulnerability’s.

These include, masquerading as an employee on social networks, targeting specific departments and people such as new starters to gain their password credentials in sophisticated phishing attacks and identifying weaknesses in staff training and procedures to gain network access.

None of these techniques are covered by standard penetration testing and this kind of attach can put you in the headlines and cause serious Brand Damage to your Organisation, our service puts your organisation through all of the above tests to see where your vulnerabilities are before they are executed by a hacker for real.